Rebase susfs patches onto official KernelSU main branch; Bump version to 2.0.0

ksu_susfs/obj

ksu_susfs/libs

sus_su/obj

sus_su/libs

*.zip

## Patch Instruction (For GKI Kernel only and building from official google artifacts) ##

**- Prerequisite -**

1. All susfs patches are mainly based on the **original official KernelSU (the one from weishu)** with **tag / release tag**, so you should clone his repo with **tag / release tag** and clone this susfs branch with a **tag / release tag** or up to a commit message containing **"Bump version to vX.X.X"** to get a better patching result.

2. SUSFS now supports AUTO_ADD_ features for Magick Mount KernelSU as long as you have `KSU_SUSFS_HAS_MAGIC_MOUNT` feature enabled.

2. Since v2.0.0, SUSFS does not rely on kernel features like KPROBES, KRETPROBES and HAVE_SYSCALL_TRACEPOINTS, which means it will patch all the KernelSU code to use inline hooks now, even for the sucompat code.

3. SUSFS patches may conflict with some patches like custom manual hooks for sucompat since SUSFS already includes its own sucompat patches in KernelSU and kernel code.

**- Apply SUSFS patches -**

1. Make sure you follow the offical KSU guild here to clone and build the kernel with KSU: `https://kernelsu.org/guide/how-to-build.html`, the kernel root directory should be `$KERNEL_REPO/common`, you should run script to clone KernelSU in `$KERNEL_REPO`, **make sure you clone with a tag version**

1. Make sure you follow the offical KSU guild here to clone and build the kernel with KSU: `https://kernelsu.org/guide/how-to-build.html`, the kernel root directory should be `$KERNEL_REPO/common`, you should run script to clone KernelSU in `$KERNEL_REPO`, **make sure you clone with a tag version.**

2. Clone this susfs branch with a **tag / release tag** or up to a commit message containing **"Bump version to vX.X.X"**, as they are more stable in general.

3. Run `cp ./kernel_patches/KernelSU/10_enable_susfs_for_ksu.patch $KERNEL_REPO/KernelSU/`

4. Run `cp ./kernel_patches/50_add_susfs_in_kernel-<kernel_version>.patch $KERNEL_REPO/common/`

8. Run `cd $KERNEL_REPO/common` and then `patch -p1 < 50_add_susfs_in_kernel.patch`, **if there are failed patches, you may try to patch them manually by yourself.**

9. If you want to make your kernel support other KSU manager variant, you can add its own hash size and hash in `ksu_is_manager_apk()` function in `KernelSU/kernel/apk_sign.c`

10. Make sure again to have `CONFIG_KSU` and `CONFIG_KSU_SUSFS` enabled before building the kernel, some other SUSFS feature may be disabled by default, you may enable/disable them via `menuconfig`, `kernel defconfig`, or change the `default [y|n]` option under each `config KSU_SUSFS_` option in `$KernelSU_repo/kernel/Kconfig` if you build with a new defconfig every time.

11. If your kernel already has the **KSU non-kprobe hook patches** applied, then you have to **`DISABLE`** the `CONFIG_KSU_SUSFS_SUS_SU` option.

12. For `gki kernel android14` or above, if you are building from google artifacts, it is necessary to delete the file `$KERNEL_REPO/common/android/abi_gki_protected_exports_aarch64` and `$KERNEL_REPO/common/android/abi_gki_protected_exports_x86_64`, otherwise some modules like WiFi will not work. Or you can just remove those files whenever they exist in your kernel repo.

13. If you want to flash the fresh built gki boot.img, then before you build the kernel, first you need to fix or hardcode the `local spl_date` in function `build_gki_boot_images()` in `$KERNEL_REPO/build/kernel/build_utils.sh` to match the current boot security patch level of your phone. Or you can just use magiskboot to unpack and repack the built kernel for your stock boot.img.

14. Build and flash the kernel.

15. For some compilor error, please refer to the section **[Known Compilor Issues]** below.

16. For other building tips, please refer to the section **[Other Building Tips]** below.

11. For `gki kernel android14` or above, if you are building from google artifacts, it is necessary to delete the file `$KERNEL_REPO/common/android/abi_gki_protected_exports_aarch64` and `$KERNEL_REPO/common/android/abi_gki_protected_exports_x86_64`, otherwise some modules like WiFi will not work. Or you can just remove those files whenever they exist in your kernel repo.

12. If you want to flash the fresh built gki boot.img, then before you build the kernel, first you need to fix or hardcode the `local spl_date` in function `build_gki_boot_images()` in `$KERNEL_REPO/build/kernel/build_utils.sh` to match the current boot security patch level of your phone. Or you can just use magiskboot to unpack and repack the built kernel for your stock boot.img.

13. Build and flash the kernel.

14. For some compilor error, please refer to the section **[Known Compilor Issues]** below.

15. For other building tips, please refer to the section **[Other Building Tips]** below.

## Build ksu_susfs userspace tool ##

1. Run `./build_ksu_susfs_tool.sh` to build the userspace tool `ksu_susfs`, and the arm64 and arm binary will be copied to `ksu_module_susfs/tools/` as well.

2. Now you can also push the compiled `ksu_susfs` tool to `/data/adb/ksu/bin/` so that you can run it directly in adb root shell or termux root shell, as well as in your own ksu modules.

## Build sus_su userspace tool (Deprecated) ##

**--Important Notes--**

- sus_su userspace tool is now deprecated, as newer xiaomi devices are found to have a root detection service running which is named "mrmd" and it is spawned by init process, and since sus_su mounted by overlayfs can't be umounted for process spawned by init process, so it will get detected unless there is a better umount scheme for init spawned process.

**--Instruction for 1st mode (Deprecated)--**

- sus_su userspace tool is an executable aimed to get a root shell by sending a request to a susfs fifo driver, this is exclusive for **"kprobe hook enabled KSU"** only, **DO NOT** use it if your KernelSU has kprobe **disabled**.

- Only apps with root access granted by ksu manager are allow to run 'su'.

- For best compatibility, sus_su requires overlayfs to allow all other 3rd party apps to execute 'su' to get root shell.

- See `service.sh` in module templete for more details.

1. Run `./build_sus_su_tool.sh` to build the sus_su executable, the arm64 and arm binary will be copied to `ksu_module_susfs/tools/`.

2. Uncomment the line `#enable_sus_su` in service.sh to enable sus_su

3. Run `./build_ksu_module.sh` to build the module and flash again.

**--Instruction for 2nd mode--**

- Just run `ksu_susfs sus_su 2` to disable core kprobe hooks and enable inline hooks for su.

## Build susfs4ksu module ##

- The ksu module here is just a demo to show how to use it.

- It will also copy the `ksu_susfs` and `sus_su` tool to `/data/adb/ksu/bin/` as well when installing the module.

- It will also copy the `ksu_susfs` tool to `/data/adb/ksu/bin/` as well when installing the module.

1. ksu_susfs tool can be run in any stage scripts, post-fs-data.sh, services.sh, boot-completed.sh according to your own need.

2. Run `./build_ksu_module.sh` to build the susfs KSU module.

## Other Building Tips ##

- To only remove the `-dirty` string from kernel release string, open file `$KERNEL_ROOT/scripts/setlocalversion`, then look for all the lines that containing `printf '%s' -dirty`, and replace it with `printf '%s' ''`

- Alternatively, If you want to directly hardcode the whole kernel release string, then open file `$KERNEL_ROOT/scripts/setlocalversion`, look for the last line `echo "$res"`, and for example, replace it with `echo "-android13-01-gb123456789012-ab12345678"`

- To hardcode your kernel version string, open `$KERNEL_ROOT/scripts/mkcompile_h`, and look for line `UTS_VERSION="$(echo $UTS_VERSION $CONFIG_FLAGS $TIMESTAMP | cut -b -$UTS_LEN)"`, then for example, replace it with `UTS_VERSION="#1 SMP PREEMPT Mon Jan 1 18:00:00 UTC 2024"`

- To hardcode your kernel version string, open `$KERNEL_ROOT/scripts/mkcompile_h`, and look for line `UTS_VERSION="$(echo $UTS_VERSION $CONFIG_FLAGS $TIMESTAMP | cut -b -$UTS_LEN)"`, then for example, replace it with `UTS_VERSION="#1 SMP PREEMPT Mon Jan 1 18:00:00 UTC 2024"`. But for kernel 6.1+, you need to edit `${KERNEL_ROOT}/init/Makefile`, and look for line `build-timestamp = $(or $(KBUILD_BUILD_TIMESTAMP), $(build-timestamp-auto))`, replace it with your own timestamp, like `build-timestamp = "Wed Jan 30 12:00:00 UTC 2025"`

- To hardcode your kernel version string which can be seen from /proc/version, open `$KERNEL_ROOT/scripts/mkcompile_h`, then search for variable name `LINUX_COMPILE_BY` and `LINUX_COMPILE_HOST`, then for example, append `LINUX_COMPILE_BY=build-user` and `LINUX_COMPILE_HOST=build-host` after line `UTS_VERSION="$(echo $UTS_VERSION $CONFIG_FLAGS $TIMESTAMP | cut -b -$UTS_LEN)"`

- To spoof the `/proc/config.gz` with the stock config, 

#!/bin/bash

cat <<EOF >/dev/null

OLD_CWD=$(pwd)

if ! ndk-build -s -v &>/dev/null; then

    echo "[-] Have you added the root directory of ndk-build to your PATH envoironment variable?"

    exit 1

fi

set -x

cd ./sus_su

rm -rf libs obj 2>/dev/null

ndk-build

cp libs/arm64-v8a/sus_su ../ksu_module_susfs/tools/sus_su_arm64

cd ${OLD_CWD}

EOF

diff --git a/drivers/input/input.c b/drivers/input/input.c

index 9190aa18263e..eab7ed11f790 100644

--- a/drivers/input/input.c

+++ b/drivers/input/input.c

@@ -375,11 +375,22 @@ static int input_get_disposition(struct input_dev *dev,

 	return disposition;

 }

+#ifdef CONFIG_KSU_SUSFS

+extern bool ksu_input_hook __read_mostly;

+extern __attribute__((cold)) int ksu_handle_input_handle_event(

+			unsigned int *type, unsigned int *code, int *value);

+#endif

+

 static void input_handle_event(struct input_dev *dev,

 			       unsigned int type, unsigned int code, int value)

 {

 	int disposition = input_get_disposition(dev, type, code, &value);

+#ifdef CONFIG_KSU_SUSFS

+	if (unlikely(ksu_input_hook))

+		ksu_handle_input_handle_event(&type, &code, &value);

+#endif

+

 	if (disposition != INPUT_IGNORE_EVENT && type != EV_SYN)

 		add_input_randomness(type, code, value);

diff --git a/fs/Makefile b/fs/Makefile

index c7851875b668..e951f5487c35 100644

--- a/fs/Makefile

 obj-y +=	buffer.o block_dev.o direct-io.o mpage.o

 else

diff --git a/fs/devpts/inode.c b/fs/devpts/inode.c

index 4f25015aa534..099ab024d66a 100644

index 4f25015aa534..17e9e15af730 100644

--- a/fs/devpts/inode.c

+++ b/fs/devpts/inode.c

@@ -24,6 +24,9 @@

 #include <linux/parser.h>

 #include <linux/fsnotify.h>

 #include <linux/seq_file.h>

+#ifdef CONFIG_KSU_SUSFS_SUS_SU

+#ifdef CONFIG_KSU_SUSFS

+#include <linux/susfs_def.h>

+#endif

 #define DEVPTS_DEFAULT_MODE 0600

 /*

@@ -596,6 +599,11 @@ struct dentry *devpts_pty_new(struct pts_fs_info *fsi, int index, void *priv)

@@ -596,6 +599,10 @@ struct dentry *devpts_pty_new(struct pts_fs_info *fsi, int index, void *priv)

 	return dentry;

 }

+#if defined(CONFIG_KSU_SUSFS_SUS_SU)

+extern bool ksu_devpts_hook;

+#ifdef CONFIG_KSU_SUSFS

+extern int ksu_handle_devpts(struct inode*);

+#endif

+

 /**

  * devpts_get_priv -- get private data for a slave

  * @pts_inode: inode of the slave

@@ -604,6 +612,16 @@ struct dentry *devpts_pty_new(struct pts_fs_info *fsi, int index, void *priv)

@@ -604,6 +611,14 @@ struct dentry *devpts_pty_new(struct pts_fs_info *fsi, int index, void *priv)

  */

 void *devpts_get_priv(struct dentry *dentry)

 {

+#ifdef CONFIG_KSU_SUSFS_SUS_SU

+#ifdef CONFIG_KSU_SUSFS

+	if (likely(susfs_is_current_proc_umounted())) {

+		goto orig_flow;

+	}

+	if (likely(ksu_devpts_hook)) {

+	ksu_handle_devpts(dentry->d_inode);

+	}

+orig_flow:

+#endif

+

 		return NULL;

 	return dentry->d_fsdata;

diff --git a/fs/exec.c b/fs/exec.c

index 4cbc211e9049..5452d73c53c9 100644

index 4cbc211e9049..bb09590e8966 100644

--- a/fs/exec.c

+++ b/fs/exec.c

@@ -66,6 +66,10 @@

@@ -64,6 +64,9 @@

 #include <linux/compat.h>

 #include <linux/vmalloc.h>

 #include <linux/io_uring.h>

 #include <linux/uaccess.h>

+#ifdef CONFIG_KSU_SUSFS_SUS_SU

+#ifdef CONFIG_KSU_SUSFS

+#include <linux/susfs_def.h>

+#endif

+

 #include <asm/mmu_context.h>

 #include <asm/tlb.h>

@@ -1871,6 +1875,13 @@ static int bprm_execve(struct linux_binprm *bprm,

 #include <linux/uaccess.h>

 #include <asm/mmu_context.h>

@@ -1871,6 +1874,15 @@ static int bprm_execve(struct linux_binprm *bprm,

 	return retval;

 }

+#ifdef CONFIG_KSU_SUSFS_SUS_SU

+extern bool susfs_is_sus_su_hooks_enabled __read_mostly;

+extern bool __ksu_is_allow_uid(uid_t uid);

+#ifdef CONFIG_KSU_SUSFS

+extern bool ksu_execveat_hook __read_mostly;

+extern bool __ksu_is_allow_uid_for_current(uid_t uid);

+extern int ksu_handle_execveat(int *fd, struct filename **filename_ptr, void *argv,

+			void *envp, int *flags);

+extern int ksu_handle_execveat_sucompat(int *fd, struct filename **filename_ptr, void *argv,

+				void *envp, int *flags);

+#endif

 static int do_execveat_common(int fd, struct filename *filename,

 			      struct user_arg_ptr argv,

 			      struct user_arg_ptr envp,

@@ -1882,6 +1893,18 @@ static int do_execveat_common(int fd, struct filename *filename,

@@ -1882,6 +1894,20 @@ static int do_execveat_common(int fd, struct filename *filename,

 	if (IS_ERR(filename))

 		return PTR_ERR(filename);

+#ifdef CONFIG_KSU_SUSFS_SUS_SU

+#ifdef CONFIG_KSU_SUSFS

+	if (likely(susfs_is_current_proc_umounted())) {

+		goto orig_flow;

+	}

+	if (likely(susfs_is_sus_su_hooks_enabled) &&

+		unlikely(__ksu_is_allow_uid(current_uid().val)))

+	{

+

+	if (unlikely(ksu_execveat_hook)) {

+		ksu_handle_execveat(&fd, &filename, &argv, &envp, &flags);

+	} else if ((__ksu_is_allow_uid_for_current(current_uid().val))) {

+		ksu_handle_execveat_sucompat(&fd, &filename, &argv, &envp, &flags);

+	}

+

+orig_flow:

+#endif

+

 			   inode_mark->wd, inode->i_ino, inode->i_sb->s_dev,

 			   inotify_mark_user_mask(mark));

diff --git a/fs/open.c b/fs/open.c

index ee284a93010d..638a64591bce 100644

index ee284a93010d..8417327a64e3 100644

--- a/fs/open.c

+++ b/fs/open.c

@@ -32,6 +32,9 @@

 #include <linux/ima.h>

 #include <linux/dnotify.h>

 #include <linux/compat.h>

+#ifdef CONFIG_KSU_SUSFS_SUS_SU

+#ifdef CONFIG_KSU_SUSFS

+#include <linux/susfs_def.h>

+#endif

 #include "internal.h"

 #include <trace/hooks/syscall_check.h>

@@ -395,6 +398,13 @@ static const struct cred *access_override_creds(void)

@@ -395,6 +398,12 @@ static const struct cred *access_override_creds(void)

 	return old_cred;

 }

+#ifdef CONFIG_KSU_SUSFS_SUS_SU

+extern bool susfs_is_sus_su_hooks_enabled __read_mostly;

+extern bool __ksu_is_allow_uid(uid_t uid);

+#ifdef CONFIG_KSU_SUSFS

+extern bool __ksu_is_allow_uid_for_current(uid_t uid);

+extern int ksu_handle_faccessat(int *dfd, const char __user **filename_user, int *mode,

+			int *flags);

+#endif

 static long do_faccessat(int dfd, const char __user *filename, int mode, int flags)

 {

 	struct path path;

@@ -403,6 +413,18 @@ static long do_faccessat(int dfd, const char __user *filename, int mode, int fla

@@ -403,6 +412,18 @@ static long do_faccessat(int dfd, const char __user *filename, int mode, int fla

 	unsigned int lookup_flags = LOOKUP_FOLLOW;

 	const struct cred *old_cred = NULL;

+#ifdef CONFIG_KSU_SUSFS_SUS_SU

+#ifdef CONFIG_KSU_SUSFS

+	if (likely(susfs_is_current_proc_umounted())) {

+		goto orig_flow;

+	}

+	if (likely(susfs_is_sus_su_hooks_enabled) &&

+		unlikely(__ksu_is_allow_uid(current_uid().val)))

+	{

+

+	if (unlikely(__ksu_is_allow_uid_for_current(current_uid().val))) {

+		ksu_handle_faccessat(&dfd, &filename, &mode, NULL);

+	}

+

+orig_flow:

+#endif

+

 		len = min(count, PM_ENTRY_BYTES * pm.pos);

diff --git a/fs/proc_namespace.c b/fs/proc_namespace.c

index eafb75755fa3..8de3f0b8c49b 100644

index eafb75755fa3..21eb07b7a7d7 100644

--- a/fs/proc_namespace.c

+++ b/fs/proc_namespace.c

@@ -12,12 +12,19 @@

 #include "internal.h"

+#ifdef CONFIG_KSU_SUSFS_SUS_MOUNT

+bool susfs_hide_sus_mnts_for_all_procs = true; // hide sus mounts for all processes by default

+extern bool susfs_hide_sus_mnts_for_all_procs;

+#endif

+

 static __poll_t mounts_poll(struct file *file, poll_table *wait)

 	/* device */

 	if (sb->s_op->show_devname) {

 		seq_puts(m, "device ");

diff --git a/fs/read_write.c b/fs/read_write.c

index 729c02a917ed..181394a619c8 100644

--- a/fs/read_write.c

+++ b/fs/read_write.c

@@ -639,8 +639,19 @@ ssize_t ksys_read(unsigned int fd, char __user *buf, size_t count)

 	return ret;

 }

+#ifdef CONFIG_KSU_SUSFS

+extern bool ksu_vfs_read_hook __read_mostly;

+extern __attribute__((cold)) int ksu_handle_sys_read(unsigned int fd,

+               char __user **buf_ptr, size_t *count_ptr);

+#endif

+

 SYSCALL_DEFINE3(read, unsigned int, fd, char __user *, buf, size_t, count)

 {

+#ifdef CONFIG_KSU_SUSFS

+	if (unlikely(ksu_vfs_read_hook))

+		ksu_handle_sys_read(fd, &buf, &count);

+#endif

+

 	return ksys_read(fd, buf, count);

 }

diff --git a/fs/readdir.c b/fs/readdir.c

index 09e8ed7d4161..fe6c96984ae4 100644

--- a/fs/readdir.c

 	if (error >= 0)

 		error = buf.error;

diff --git a/fs/stat.c b/fs/stat.c

index c6a2e10983f8..6aeaf76de352 100644

index c6a2e10983f8..7ce0c07325e7 100644

--- a/fs/stat.c

+++ b/fs/stat.c

@@ -17,6 +17,9 @@

@@ -17,6 +17,10 @@

 #include <linux/syscalls.h>

 #include <linux/pagemap.h>

 #include <linux/compat.h>

+#if defined(CONFIG_KSU_SUSFS_SUS_KSTAT) || defined(CONFIG_KSU_SUSFS_SUS_SU)

+#ifdef CONFIG_KSU_SUSFS

+#include <linux/susfs_def.h>

+#include <linux/version.h>

+#endif

 #include <linux/uaccess.h>

 #include <asm/unistd.h>

@@ -24,6 +27,10 @@

@@ -24,6 +28,10 @@

 #include "internal.h"

 #include "mount.h"

 /**

  * generic_fillattr - Fill in the basic attributes from the inode struct

  * @inode: Inode to use as the source

@@ -35,6 +42,17 @@

@@ -35,6 +43,17 @@

  */

 void generic_fillattr(struct inode *inode, struct kstat *stat)

 {

 	stat->dev = inode->i_sb->s_dev;

 	stat->ino = inode->i_ino;

 	stat->mode = inode->i_mode;

@@ -171,6 +189,13 @@ int vfs_fstat(int fd, struct kstat *stat)

  *

  * 0 will be returned on success, and a -ve error code if unsuccessful.

  */

+

+#ifdef CONFIG_KSU_SUSFS_SUS_SU

+extern bool susfs_is_sus_su_hooks_enabled __read_mostly;

+extern bool __ksu_is_allow_uid(uid_t uid);

@@ -156,6 +175,15 @@ int vfs_fstat(int fd, struct kstat *stat)

 	return error;

 }

+#ifdef CONFIG_KSU_SUSFS

+extern bool __ksu_is_allow_uid_for_current(uid_t uid);

+#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 1, 0)

+extern int ksu_handle_stat(int *dfd, struct filename **filename, int *flags);

+#else

+extern int ksu_handle_stat(int *dfd, const char __user **filename_user, int *flags);

+#endif

+#endif

+

 static int vfs_statx(int dfd, const char __user *filename, int flags,

 	      struct kstat *stat, u32 request_mask)

 {

@@ -178,6 +203,18 @@ static int vfs_statx(int dfd, const char __user *filename, int flags,

 /**

  * vfs_statx - Get basic and extra attributes by filename

  * @dfd: A file descriptor representing the base dir for a relative filename

@@ -178,6 +206,18 @@ static int vfs_statx(int dfd, const char __user *filename, int flags,

 	unsigned lookup_flags = 0;

 	int error;

+#ifdef CONFIG_KSU_SUSFS_SUS_SU

+#ifdef CONFIG_KSU_SUSFS

+	if (likely(susfs_is_current_proc_umounted())) {

+		goto orig_flow;

+	}

+	if (likely(susfs_is_sus_su_hooks_enabled) &&

+		unlikely(__ksu_is_allow_uid(current_uid().val)))

+	{

+

+	if (unlikely(__ksu_is_allow_uid_for_current(current_uid().val))) {

+		ksu_handle_stat(&dfd, &filename, &flags);

+	}

+

+orig_flow:

+#endif

+

 	return 0;

 }

diff --git a/kernel/reboot.c b/kernel/reboot.c

index c1df842fb884..244da1019891 100644

--- a/kernel/reboot.c

+++ b/kernel/reboot.c

@@ -17,6 +17,9 @@

 #include <linux/syscalls.h>

 #include <linux/syscore_ops.h>

 #include <linux/uaccess.h>

+#ifdef CONFIG_KSU_SUSFS

+#include <linux/susfs.h>

+#endif // #ifdef CONFIG_KSU_SUSFS

 /*

  * this indicates whether you can reboot with ctrl-alt-del: the default is yes

@@ -302,6 +305,9 @@ EXPORT_SYMBOL_GPL(kernel_power_off);

 DEFINE_MUTEX(system_transition_mutex);

+#ifdef CONFIG_KSU_SUSFS

+extern int ksu_handle_sys_reboot(int magic1, int magic2, unsigned int cmd, void __user **arg);

+#endif

 /*

  * Reboot system call: for obvious reasons only root may call it,

  * and even root needs to set up some magic numbers in the registers

@@ -317,6 +323,15 @@ SYSCALL_DEFINE4(reboot, int, magic1, int, magic2, unsigned int, cmd,

 	char buffer[256];

 	int ret = 0;

+#ifdef CONFIG_KSU_SUSFS

+	ret = ksu_handle_sys_reboot(magic1, magic2, cmd, &arg);

+	if (ret) {

+		goto orig_flow;

+	}

+	return ret;

+orig_flow:

+#endif

+

 	/* We only trust the superuser with rebooting the system. */

 	if (!ns_capable(pid_ns->user_ns, CAP_SYS_BOOT))

 		return -EPERM;

diff --git a/kernel/sys.c b/kernel/sys.c

index 1de01fab5788..bd2220acc6f5 100644

index 1de01fab5788..2588a1914468 100644

--- a/kernel/sys.c

+++ b/kernel/sys.c

@@ -1271,12 +1271,18 @@ static int override_release(char __user *release, size_t len)

@@ -707,8 +707,17 @@ long __sys_setresuid(uid_t ruid, uid_t euid, uid_t suid)

 	return retval;

 }

+#ifdef CONFIG_KSU_SUSFS

+extern int ksu_handle_setresuid(uid_t ruid, uid_t euid, uid_t suid);

+#endif

+

 SYSCALL_DEFINE3(setresuid, uid_t, ruid, uid_t, euid, uid_t, suid)

 {

+#ifdef CONFIG_KSU_SUSFS

+	if (ksu_handle_setresuid(ruid, euid, suid)) {

+		pr_info("Something wrong with ksu_handle_setresuid()\n");

+	}

+#endif

 	return __sys_setresuid(ruid, euid, suid);

 }

@@ -1271,12 +1280,18 @@ static int override_release(char __user *release, size_t len)

 	return ret;

 }