Commit 9f8d4e10 authored by topjohnwu's avatar topjohnwu

Properly isolate mount namespace

parent d1dfda40
...@@ -10,6 +10,7 @@ ...@@ -10,6 +10,7 @@
#include <sys/types.h> #include <sys/types.h>
#include <sys/stat.h> #include <sys/stat.h>
#include <sys/wait.h> #include <sys/wait.h>
#include <sys/mount.h>
#include <magisk.h> #include <magisk.h>
#include <daemon.h> #include <daemon.h>
...@@ -308,14 +309,13 @@ void su_daemon_handler(int client, struct ucred *credential) { ...@@ -308,14 +309,13 @@ void su_daemon_handler(int client, struct ucred *credential) {
break; break;
case NAMESPACE_MODE_REQUESTER: case NAMESPACE_MODE_REQUESTER:
LOGD("su: use namespace of pid=[%d]\n", ctx.pid); LOGD("su: use namespace of pid=[%d]\n", ctx.pid);
if (switch_mnt_ns(ctx.pid)) { if (switch_mnt_ns(ctx.pid))
LOGD("su: setns failed, fallback to isolated\n"); LOGD("su: setns failed, fallback to global\n");
xunshare(CLONE_NEWNS);
}
break; break;
case NAMESPACE_MODE_ISOLATE: case NAMESPACE_MODE_ISOLATE:
LOGD("su: use new isolated namespace\n"); LOGD("su: use new isolated namespace\n");
xunshare(CLONE_NEWNS); xunshare(CLONE_NEWNS);
xmount(nullptr, "/", nullptr, MS_PRIVATE | MS_REC, nullptr);
break; break;
} }
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment