[aviraxp]

This was deliberately not done because app cannot run custom code from isolated processes forked from webview zygote. However, hidepid=2 is broken for android again.

In 2020, Jann Horn discovered that when zygote forks and specializes to app zygote, process groups are not cleaned. This makes app zygote and its child have AID_READPROC and bypass hidepid=2. This was marked as CVE-2020-0257 and fixed in 2020-08-01.

However, it is ignored that isolated process can get directly forked from zygote while no app zygote fork is needed. So isolated_app context process still may have AID_READPROC, which provides a way to bypass the hidepid=2 restrictions on /proc.

The impact is limited by SELinux because isolated_app does not have mlstrustedsubject. But it can still read cmdline, comm, maps, mountinfo etc of other isolated processes, mainly webview sandboxed processes.

Bangcle, a famous commercial app protection service in China, started to make use of this recently. An isolated process is forked and iterates through all pids, trying to open their mountinfo.

This is no doubt an exploit (almost same with CVE-2020-0257) and we have already reported it to Google. Before Google fixes it, we have no way but unmount anything for webview zygote. This is expected to break some font modules aimed at webview, but we have no choice.

[aviraxp]

Open for discussion. I cannot think of a better idea.

[Copilot]

Pull request overview

Introduces a new kernel/userspace/Manager feature flag to unmount module mount points from the WebView zygote (and thereby prevent mountinfo leaks to isolated WebView sandbox processes), addressing a hidepid=2 bypass scenario described in the PR.

Changes:

• Add KSU_FEATURE_WEBVIEW_ZYGOTE_UMOUNT (ID=5) to the shared UAPI and wire it through ksud feature config/CLI.
• Expose a new toggle in the Android Manager (UI + repository + JNI bridge) for enabling/disabling the feature.
• Update kernel umount policy to optionally umount for WEBVIEW_ZYGOTE_UID based on the new feature.

Reviewed changes

Copilot reviewed 19 out of 19 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
userspace/ksud/src/feature.rs	Adds new FeatureId mapping/name/description and includes it in list/save paths.
userspace/ksud/src/cli.rs	Updates CLI help text to include webview_zygote_umount.
uapi/feature.h	Adds KSU_FEATURE_WEBVIEW_ZYGOTE_UMOUNT = 5 to the feature ID enum.
manager/app/src/main/res/values/strings.xml	Adds English UI strings for the new WebView zygote umount setting.
manager/app/src/main/res/values-zh-rCN/strings.xml	Adds Simplified Chinese UI strings for the new setting.
manager/app/src/main/java/me/weishu/kernelsu/ui/viewmodel/SettingsViewModel.kt	Loads and toggles the new feature in settings state.
manager/app/src/main/java/me/weishu/kernelsu/ui/screen/settings/SettingsUiState.kt	Adds UI state fields + action callback for the new setting.
manager/app/src/main/java/me/weishu/kernelsu/ui/screen/settings/SettingsScreen.kt	Wires the new action from screen to ViewModel.
manager/app/src/main/java/me/weishu/kernelsu/ui/screen/settings/SettingsMiuix.kt	Adds a switch preference for the new feature in MIUIX UI.
manager/app/src/main/java/me/weishu/kernelsu/ui/screen/settings/SettingsMaterial.kt	Adds a segmented switch item for the new feature in Material UI.
manager/app/src/main/java/me/weishu/kernelsu/Natives.kt	Adds JNI-backed native methods for getting/setting the new feature.
manager/app/src/main/java/me/weishu/kernelsu/data/repository/SettingsRepositoryImpl.kt	Implements status/get/set plumbing for the new feature.
manager/app/src/main/java/me/weishu/kernelsu/data/repository/SettingsRepository.kt	Extends repository interface with the new feature APIs.
manager/app/src/main/cpp/ksu.h	Declares new C++ bridge functions for the feature.
manager/app/src/main/cpp/ksu.cc	Implements get/set via get_feature/set_feature for the new feature ID.
manager/app/src/main/cpp/jni.cc	Exposes the new native methods to Kotlin via JNI.
kernel/policy/allowlist.c	Switches WEBVIEW_ZYGOTE_UID umount decision to be feature-controlled.
kernel/feature/kernel_umount.h	Declares ksu_is_webview_zygote_umount_enabled().
kernel/feature/kernel_umount.c	Adds the new feature handler, state, and enables umount handling for the WebView zygote UID.

Suppressed comments (1)

kernel/feature/kernel_umount.c:122

• ksu_handle_umount() reads ksu_kernel_umount_enabled without READ_ONCE(), but the flag can be updated concurrently via the feature set handler. This can trigger KCSAN data-race reports; use READ_ONCE() here as well.

    // 4. Webview zygote forked from zygote: zygote -> webview_zygote (controlled by feature policy)
    // 5. Isolated process forked from app zygote: appuid -> isolated_process (already handled by 3)
    // 6. Isolated process forked from webview zygote (already handled by 4)
    if (!is_appuid(new_uid) && new_uid != WEBVIEW_ZYGOTE_UID && !is_isolated_process(new_uid)) {
        return 0;

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

The new kernel feature flag is accessed across code paths without READ_ONCE/WRITE_ONCE (data-race risk), and one updated scenario comment is misleading relative to the actual control flow.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Suppressed comments (1)

kernel/feature/kernel_umount.c:115

• The updated scenario comment is misleading: isolated UIDs are still handled primarily via the is_isolated_process(new_uid) path (independent of the WebView zygote feature flag). Please clarify the scenario description to match the actual control flow.

    // 4. Webview zygote forked from zygote: zygote -> webview_zygote (controlled by feature policy)
    // 5. Isolated process forked from app zygote: appuid -> isolated_process (already handled by 3)
    // 6. Isolated process forked from webview zygote (already handled by 4)

• Files reviewed: 19/19 changed files
• Comments generated: 2
• Review effort level: Lite

[JingMatrix]

To me, it suffice to treat the webview_zygote as a legal target for denylist.
The detection point is on inconsistency, hence I provide webview_zygote the same mount namespace that a normal isolated process (belonging to a detector) would receive. See JingMatrix/NeoZygisk@ec29fb1

[aviraxp]

As I said in commit message, this is expected to break some font modules aimed at webview, because fonts are usually loaded in sandboxed process forked from webview zygote. Webview zygote is previously not unmounted for this exact reason, as per a user request. So I provided a toggle.

If some fonts work, that is just because a few common fonts are preloaded in zygote.

[JingMatrix]

In this case, to address the user need, isn't propagating webview_zygote as a configurable process to the profile setting the right move ?

The underlying issue of detection was simply neglecting webview_zygote as configurable process.

[aviraxp]

The issue is as long as there is one not-unmounted sandboxed isolated process running, the detection will work. So one match = all match. So I don't think it makes too much sense to make it toggable per-app. Also there is no easy way to do this without a userspace daemon, maybe need to parse cmdline in process's stack.

[JingMatrix]

I meant show webview_zygote as an app which you can configure its profile (deny list).

Not a per app sense as you have understood.