MagiskHide is no more

native/jni/Android.mk

@@ -22,9 +22,9 @@ LOCAL_SRC_FILES := \
     core/module.cpp \
     core/logging.cpp \
     core/thread.cpp \
-    magiskhide/magiskhide.cpp \
-    magiskhide/hide_utils.cpp \
-    magiskhide/hide_policy.cpp \
+    deny/cli.cpp \
+    deny/utils.cpp \
+    deny/revert.cpp \
     resetprop/persist_properties.cpp \
     resetprop/resetprop.cpp \
     su/su.cpp \

native/jni/core/applets.cpp

@@ -10,7 +10,7 @@ using namespace std;
 
 using main_fun = int (*)(int, char *[]);
 
-static main_fun applet_main[] = { su_client_main, resetprop_main, magiskhide_main, nullptr };
+static main_fun applet_main[] = { su_client_main, resetprop_main, nullptr };
 
 static int call_applet(int argc, char *argv[]) {
     // Applets

native/jni/core/bootstages.cpp

@@ -296,12 +296,12 @@ void post_fs_data(int client) {
 
     if (getprop("persist.sys.safemode", true) == "1" || check_key_combo()) {
         safe_mode = true;
-        // Disable all modules and magiskhide so next boot will be clean
+        // Disable all modules and denylist so next boot will be clean
         disable_modules();
-        disable_hide();
+        disable_deny();
     } else {
         exec_common_scripts("post-fs-data");
-        check_enable_hide();
+        check_enforce_denylist();
         handle_modules();
     }
 
@@ -350,7 +350,7 @@ void boot_complete(int client) {
     if (access(SECURE_DIR, F_OK) != 0)
         xmkdir(SECURE_DIR, 0700);
 
-    check_enable_hide();
+    check_enforce_denylist();
 
     if (!check_manager()) {
         if (access(MANAGERAPK, F_OK) == 0) {

native/jni/core/daemon.cpp

@@ -44,8 +44,8 @@ static bool check_zygote(pid_t pid) {
 
 static void handle_request_async(int client, int code, ucred cred) {
     switch (code) {
-    case MAGISKHIDE:
-        magiskhide_handler(client, &cred);
+    case DENYLIST:
+        denylist_handler(client, &cred);
         break;
     case SUPERUSER:
         su_daemon_handler(client, &cred);
@@ -92,7 +92,7 @@ static void handle_request_sync(int client, int code) {
         setup_logfile(true);
         break;
     case STOP_DAEMON:
-        magiskhide_handler(-1, nullptr);
+        denylist_handler(-1, nullptr);
         write_int(client, 0);
         // Terminate the daemon!
         exit(0);
@@ -124,7 +124,7 @@ static void handle_request(int client) {
     case BOOT_COMPLETE:
     case SQLITE_CMD:
     case GET_PATH:
-    case MAGISKHIDE:
+    case DENYLIST:
     case STOP_DAEMON:
         if (!is_root) {
             write_int(client, ROOT_REQUIRED);

native/jni/core/db.cpp

@@ -7,7 +7,7 @@
 #include <socket.hpp>
 #include <utils.hpp>
 
-#define DB_VERSION 10
+#define DB_VERSION 11
 
 using namespace std;
 
@@ -112,7 +112,7 @@ db_settings::db_settings() {
     data[ROOT_ACCESS] = ROOT_ACCESS_APPS_AND_ADB;
     data[SU_MULTIUSER_MODE] = MULTIUSER_MODE_OWNER_ONLY;
     data[SU_MNT_NS] = NAMESPACE_MODE_REQUESTER;
-    data[HIDE_CONFIG] = false;
+    data[DENYLIST_CONFIG] = false;
 }
 
 int db_settings::get_idx(string_view key) const {
@@ -174,12 +174,6 @@ static char *open_and_init_db(sqlite3 *&db) {
                 "(key TEXT, value TEXT, PRIMARY KEY(key))",
                 nullptr, nullptr, &err);
         err_ret(err);
-        ver = 4;
-        upgrade = true;
-    }
-    if (ver < 5) {
-        sqlite3_exec(db, "UPDATE policies SET uid=uid%100000", nullptr, nullptr, &err);
-        err_ret(err);
         /* Directly jump to version 6 */
         ver = 6;
         upgrade = true;
@@ -229,6 +223,17 @@ static char *open_and_init_db(sqlite3 *&db) {
         ver = 10;
         upgrade = true;
     }
+    if (ver < 11) {
+        sqlite3_exec(db,
+                "DROP TABLE IF EXISTS hidelist;"
+                "CREATE TABLE IF NOT EXISTS denylist "
+                "(package_name TEXT, process TEXT, PRIMARY KEY(package_name, process));"
+                "DELETE FROM settings WHERE key='magiskhide';",
+                nullptr, nullptr, &err);
+        err_ret(err);
+        ver = 11;
+        upgrade = true;
+    }
 
     if (upgrade) {
         // Set version

native/jni/core/magisk.cpp

@@ -38,6 +38,7 @@ Advanced Options (Internal APIs):
    --clone SRC DEST          clone SRC to DEST
    --sqlite SQL              exec SQL commands to Magisk database
    --path                    print Magisk tmpfs mount path
+   --denylist ARGS           denylist config CLI
 
 Available applets:
 )EOF");
@@ -101,7 +102,9 @@ int magisk_main(int argc, char *argv[]) {
         int fd = connect_daemon(true);
         write_int(fd, BOOT_COMPLETE);
         return read_int(fd);
-    } else if (argc >= 3 && argv[1] == "--sqlite"sv) {
+    } else if (argv[1] == "--denylist"sv) {
+        return denylist_cli(argc - 1, argv + 1);
+    }else if (argc >= 3 && argv[1] == "--sqlite"sv) {
         int fd = connect_daemon();
         write_int(fd, SQLITE_CMD);
         write_string(fd, argv[2]);

native/jni/deny/cli.cpp

@@ -0,0 +1,154 @@
+#include <sys/wait.h>
+#include <sys/mount.h>
+
+#include <utils.hpp>
+
+#include "deny.hpp"
+
+using namespace std;
+
+[[noreturn]] static void usage() {
+    fprintf(stderr,
+R"EOF("DenyList Config CLI
+
+Usage: magisk --denylist [action [arguments...] ]
+Actions:
+   status          Return the enforcement status
+   enable          Enable denylist enforcement
+   disable         Disable denylist enforcement
+   add PKG [PROC]  Add a new target to the denylist
+   rm PKG [PROC]   Remove target(s) from the denylist
+   ls              Print the current denylist
+   exec CMDs...    Execute commands in isolated mount
+                   namespace and do all unmounts
+)EOF");
+    exit(1);
+}
+
+void denylist_handler(int client, ucred *cred) {
+    if (client < 0) {
+        revert_unmount();
+        return;
+    }
+
+    int req = read_int(client);
+    int res = DAEMON_ERROR;
+
+    switch (req) {
+    case DISABLE_DENY:
+    case ADD_LIST:
+    case RM_LIST:
+    case LS_LIST:
+        if (!deny_enforced()) {
+            write_int(client, DENY_NOT_ENFORCED);
+            close(client);
+            return;
+        }
+    }
+
+    switch (req) {
+    case ENFORCE_DENY:
+        res = enable_hide();
+        break;
+    case DISABLE_DENY:
+        res = disable_deny();
+        break;
+    case ADD_LIST:
+        res = add_list(client);
+        break;
+    case RM_LIST:
+        res = rm_list(client);
+        break;
+    case LS_LIST:
+        ls_list(client);
+        return;
+    case DENY_STATUS:
+        res = deny_enforced() ? DENY_IS_ENFORCED : DENY_NOT_ENFORCED;
+        break;
+    }
+
+    write_int(client, res);
+    close(client);
+}
+
+int denylist_cli(int argc, char **argv) {
+    if (argc < 2)
+        usage();
+
+    int req;
+    if (argv[1] == "enable"sv)
+        req = ENFORCE_DENY;
+    else if (argv[1] == "disable"sv)
+        req = DISABLE_DENY;
+    else if (argv[1] == "add"sv)
+        req = ADD_LIST;
+    else if (argv[1] == "rm"sv)
+        req = RM_LIST;
+    else if (argv[1] == "ls"sv)
+        req = LS_LIST;
+    else if (argv[1] == "status"sv)
+        req = DENY_STATUS;
+    else if (argv[1] == "exec"sv && argc > 2) {
+        xunshare(CLONE_NEWNS);
+        xmount(nullptr, "/", nullptr, MS_PRIVATE | MS_REC, nullptr);
+        revert_unmount();
+        execvp(argv[2], argv + 2);
+        exit(1);
+    } else {
+        usage();
+    }
+
+    // Send request
+    int fd = connect_daemon();
+    write_int(fd, DENYLIST);
+    write_int(fd, req);
+    if (req == ADD_LIST || req == RM_LIST) {
+        write_string(fd, argv[2]);
+        write_string(fd, argv[3] ? argv[3] : "");
+    }
+
+    // Get response
+    int code = read_int(fd);
+    switch (code) {
+    case DAEMON_SUCCESS:
+        break;
+    case DENY_NOT_ENFORCED:
+        fprintf(stderr, "Denylist is not enforced\n");
+        goto return_code;
+    case DENY_IS_ENFORCED:
+        fprintf(stderr, "Denylist is enforced\n");
+        goto return_code;
+    case DENYLIST_ITEM_EXIST:
+        fprintf(stderr, "Target already exists in denylist\n");
+        goto return_code;
+    case DENYLIST_ITEM_NOT_EXIST:
+        fprintf(stderr, "Target does not exist in denylist\n");
+        goto return_code;
+    case DENY_NO_NS:
+        fprintf(stderr, "The kernel does not support mount namespace\n");
+        goto return_code;
+    case DENYLIST_INVALID_PKG:
+        fprintf(stderr, "Invalid package / process name\n");
+        goto return_code;
+    case ROOT_REQUIRED:
+        fprintf(stderr, "Root is required for this operation\n");
+        goto return_code;
+    case DAEMON_ERROR:
+    default:
+        fprintf(stderr, "Daemon error\n");
+        return DAEMON_ERROR;
+    }
+
+    if (req == LS_LIST) {
+        string res;
+        for (;;) {
+            read_string(fd, res);
+            if (res.empty())
+                break;
+            printf("%s\n", res.data());
+        }
+    }
+
+return_code:
+    return req == DENY_STATUS ? (code == DENY_IS_ENFORCED ? 0 : 1) : code != DAEMON_SUCCESS;
+}

native/jni/deny/deny.hpp

@@ -0,0 +1,43 @@
+#pragma once
+
+#include <pthread.h>
+#include <string_view>
+#include <functional>
+#include <map>
+
+#include <daemon.hpp>
+
+#define ISOLATED_MAGIC "isolated"
+
+// CLI entries
+int enable_hide();
+int disable_deny();
+int add_list(int client);
+int rm_list(int client);
+void ls_list(int client);
+
+// Utility functions
+bool deny_enforced();
+bool is_deny_target(int uid, std::string_view process);
+
+// Revert
+void revert_daemon(int pid, int client);
+void revert_unmount(int pid = -1);
+
+enum : int {
+    ENFORCE_DENY,
+    DISABLE_DENY,
+    ADD_LIST,
+    RM_LIST,
+    LS_LIST,
+    DENY_STATUS,
+};
+
+enum : int {
+    DENY_IS_ENFORCED = DAEMON_LAST + 1,
+    DENY_NOT_ENFORCED,
+    DENYLIST_ITEM_EXIST,
+    DENYLIST_ITEM_NOT_EXIST,
+    DENYLIST_INVALID_PKG,
+    DENY_NO_NS,
+};

native/jni/deny/revert.cpp

@@ -5,18 +5,18 @@
 #include <selinux.hpp>
 #include <resetprop.hpp>
 
-#include "magiskhide.hpp"
+#include "deny.hpp"
 
 using namespace std;
 
 static void lazy_unmount(const char* mountpoint) {
     if (umount2(mountpoint, MNT_DETACH) != -1)
-        LOGD("hide: Unmounted (%s)\n", mountpoint);
+        LOGD("denylist: Unmounted (%s)\n", mountpoint);
 }
 
-void hide_daemon(int pid, int client) {
+void revert_daemon(int pid, int client) {
     if (fork_dont_care() == 0) {
-        hide_unmount(pid);
+        revert_unmount(pid);
         write_int(client, 0);
         _exit(0);
     }
@@ -24,11 +24,11 @@ void hide_daemon(int pid, int client) {
 
 #define TMPFS_MNT(dir) (mentry->mnt_type == "tmpfs"sv && str_starts(mentry->mnt_dir, "/" #dir))
 
-void hide_unmount(int pid) {
+void revert_unmount(int pid) {
     if (pid > 0) {
         if (switch_mnt_ns(pid))
             return;
-        LOGD("hide: handling PID=[%d]\n", pid);
+        LOGD("denylist: handling PID=[%d]\n", pid);
     }
 
     vector<string> targets;

native/jni/deny/utils.cpp

@@ -9,17 +9,17 @@
 #include <utils.hpp>
 #include <db.hpp>
 
-#include "magiskhide.hpp"
+#include "deny.hpp"
 
 using namespace std;
 
-static set<pair<string, string>> *hide_set;          /* set of <pkg, process> pair */
+static set<pair<string, string>> *deny_set;          /* set of <pkg, process> pair */
 static map<int, vector<string_view>> *uid_proc_map;  /* uid -> list of process */
 
 // Locks the variables above
-static pthread_mutex_t hide_data_lock = PTHREAD_MUTEX_INITIALIZER;
+static pthread_mutex_t data_lock = PTHREAD_MUTEX_INITIALIZER;
 
-static atomic<bool> hide_state = false;
+static atomic<bool> enforcement_status = false;
 
 static void rebuild_uid_map() {
     uid_proc_map->clear();
@@ -34,7 +34,7 @@ static void rebuild_uid_map() {
         data_path += '/';
         size_t user_len = data_path.length();
         struct stat st;
-        for (const auto &hide : *hide_set) {
+        for (const auto &hide : *deny_set) {
             if (hide.first == ISOLATED_MAGIC) {
                 if (!first_iter) continue;
                 // Setup isolated processes
@@ -72,7 +72,7 @@ static bool proc_name_match(int pid, const char *name) {
     if (auto fp = open_file(buf, "re")) {
         fgets(buf, sizeof(buf), fp.get());
         if (str_op(buf, name)) {
-            LOGD("hide: kill PID=[%d] (%s)\n", pid, buf);
+            LOGD("denylist: kill PID=[%d] (%s)\n", pid, buf);
             return true;
         }
     }
@@ -129,8 +129,8 @@ static bool validate(const char *pkg, const char *proc) {
 }
 
 static void add_hide_set(const char *pkg, const char *proc) {
-    LOGI("hide_list add: [%s/%s]\n", pkg, proc);
-    hide_set->emplace(pkg, proc);
+    LOGI("denylist add: [%s/%s]\n", pkg, proc);
+    deny_set->emplace(pkg, proc);
     if (strcmp(pkg, ISOLATED_MAGIC) == 0) {
         // Kill all matching isolated processes
         kill_process<&str_starts>(proc, true);
@@ -144,14 +144,14 @@ static int add_list(const char *pkg, const char *proc) {
         proc = pkg;
 
     if (!validate(pkg, proc))
-        return HIDE_INVALID_PKG;
+        return DENYLIST_INVALID_PKG;
 
     {
         // Critical region
-        mutex_guard lock(hide_data_lock);
-        for (const auto &hide : *hide_set)
+        mutex_guard lock(data_lock);
+        for (const auto &hide : *deny_set)
             if (hide.first == pkg && hide.second == proc)
-                return HIDE_ITEM_EXIST;
+                return DENYLIST_ITEM_EXIST;
         add_hide_set(pkg, proc);
         rebuild_uid_map();
     }
@@ -159,7 +159,7 @@ static int add_list(const char *pkg, const char *proc) {
     // Add to database
     char sql[4096];
     snprintf(sql, sizeof(sql),
-            "INSERT INTO hidelist (package_name, process) VALUES('%s', '%s')", pkg, proc);
+            "INSERT INTO denylist (package_name, process) VALUES('%s', '%s')", pkg, proc);
     char *err = db_exec(sql);
     db_err_cmd(err, return DAEMON_ERROR);
     return DAEMON_SUCCESS;
@@ -175,27 +175,27 @@ static int rm_list(const char *pkg, const char *proc) {
     bool remove = false;
     {
         // Critical region
-        mutex_guard lock(hide_data_lock);
-        for (auto it = hide_set->begin(); it != hide_set->end();) {
+        mutex_guard lock(data_lock);
+        for (auto it = deny_set->begin(); it != deny_set->end();) {
             if (it->first == pkg && (proc[0] == '\0' || it->second == proc)) {
                 remove = true;
-                LOGI("hide_list rm: [%s/%s]\n", it->first.data(), it->second.data());
-                it = hide_set->erase(it);
+                LOGI("denylist rm: [%s/%s]\n", it->first.data(), it->second.data());
+                it = deny_set->erase(it);
             } else {
                 ++it;
             }
         }
         if (!remove)
-            return HIDE_ITEM_NOT_EXIST;
+            return DENYLIST_ITEM_NOT_EXIST;
         rebuild_uid_map();
     }
 
     char sql[4096];
     if (proc[0] == '\0')
-        snprintf(sql, sizeof(sql), "DELETE FROM hidelist WHERE package_name='%s'", pkg);
+        snprintf(sql, sizeof(sql), "DELETE FROM denylist WHERE package_name='%s'", pkg);
     else
         snprintf(sql, sizeof(sql),
-                "DELETE FROM hidelist WHERE package_name='%s' AND process='%s'", pkg, proc);
+                "DELETE FROM denylist WHERE package_name='%s' AND process='%s'", pkg, proc);
     char *err = db_exec(sql);
     db_err_cmd(err, return DAEMON_ERROR);
     return DAEMON_SUCCESS;
@@ -215,9 +215,9 @@ static bool str_ends_safe(string_view s, string_view ss) {
 }
 
 static bool init_list() {
-    LOGD("hide: initialize\n");
+    LOGD("denylist: initialize\n");
 
-    char *err = db_exec("SELECT * FROM hidelist", [](db_row &row) -> bool {
+    char *err = db_exec("SELECT * FROM denylist", [](db_row &row) -> bool {
         add_hide_set(row["package_name"].data(), row["process"].data());
         return true;
     });
@@ -236,8 +236,8 @@ static bool init_list() {
 void ls_list(int client) {
     write_int(client, DAEMON_SUCCESS);
     {
-        mutex_guard lock(hide_data_lock);
-        for (const auto &hide : *hide_set) {
+        mutex_guard lock(data_lock);
+        for (const auto &hide : *deny_set) {
             write_int(client, hide.first.size() + hide.second.size() + 1);
             xwrite(client, hide.first.data(), hide.first.size());
             xwrite(client, "|", 1);
@@ -251,65 +251,65 @@ void ls_list(int client) {
 static void update_hide_config() {
     char sql[64];
     sprintf(sql, "REPLACE INTO settings (key,value) VALUES('%s',%d)",
-            DB_SETTING_KEYS[HIDE_CONFIG], hide_state.load());
+            DB_SETTING_KEYS[DENYLIST_CONFIG], enforcement_status.load());
     char *err = db_exec(sql);
     db_err(err);
 }
 
 int enable_hide() {
-    if (hide_state)
-        return HIDE_IS_ENABLED;
+    if (enforcement_status)
+        return DENY_IS_ENFORCED;
 
     if (access("/proc/self/ns/mnt", F_OK) != 0)
-        return HIDE_NO_NS;
+        return DENY_NO_NS;
 
     if (procfp == nullptr && (procfp = opendir("/proc")) == nullptr)
         return DAEMON_ERROR;
 
-    LOGI("* Enable MagiskHide\n");
+    LOGI("* Enforce DenyList\n");
 
-    mutex_guard lock(hide_data_lock);
-    default_new(hide_set);
+    mutex_guard lock(data_lock);
+    default_new(deny_set);
     default_new(uid_proc_map);
 
     // Initialize the hide list
     if (!init_list())
         return DAEMON_ERROR;
 
-    hide_state = true;
+    enforcement_status = true;
     update_hide_config();
 
     rebuild_uid_map();
     return DAEMON_SUCCESS;
 }
 
-int disable_hide() {
-    mutex_guard lock(hide_data_lock);
+int disable_deny() {
+    mutex_guard lock(data_lock);
 
-    if (hide_state) {
-        LOGI("* Disable MagiskHide\n");
+    if (enforcement_status) {
+        LOGI("* Disable DenyList\n");
         delete uid_proc_map;
-        delete hide_set;
+        delete deny_set;
         uid_proc_map = nullptr;
-        hide_set = nullptr;
+        deny_set = nullptr;
     }
 
-    hide_state = false;
+    enforcement_status = false;
     update_hide_config();
     return DAEMON_SUCCESS;
 }
 
-void check_enable_hide() {
-    if (!hide_state) {
+void check_enforce_denylist() {
+    if (!enforcement_status) {
         db_settings dbs;
-        get_db_settings(dbs, HIDE_CONFIG);
-        if (dbs[HIDE_CONFIG])
+        get_db_settings(dbs, DENYLIST_CONFIG);
+        if (dbs[DENYLIST_CONFIG])
             enable_hide();
     }
 }
 
-bool is_hide_target(int uid, string_view process) {
-    mutex_guard lock(hide_data_lock);
+bool is_deny_target(int uid, string_view process) {
+    mutex_guard lock(data_lock);
 
     if (uid % 100000 >= 90000) {
         // Isolated processes
@@ -334,6 +334,6 @@ bool is_hide_target(int uid, string_view process) {
     return false;
 }
 
-bool hide_enabled() {
-    return hide_state;
+bool deny_enforced() {
+    return enforcement_status;
 }

native/jni/include/daemon.hpp

@@ -24,7 +24,7 @@ enum : int {
     POST_FS_DATA,
     LATE_START,
     BOOT_COMPLETE,
-    MAGISKHIDE,
+    DENYLIST,
     SQLITE_CMD,
     REMOVE_MODULES,
     ZYGISK_REQUEST,
@@ -58,10 +58,11 @@ void android_logging();
 void post_fs_data(int client);
 void late_start(int client);
 void boot_complete(int client);
-void magiskhide_handler(int client, ucred *cred);
+void denylist_handler(int client, ucred *cred);
 void su_daemon_handler(int client, ucred *credential);
 void zygisk_handler(int client, ucred *cred);
 
-// MagiskHide
-void check_enable_hide();
-int disable_hide();
+// Denylist
+void check_enforce_denylist();
+int disable_deny();
+int denylist_cli(int argc, char **argv);

native/jni/include/db.hpp

@@ -38,7 +38,7 @@ constexpr const char *DB_SETTING_KEYS[] = {
     "root_access",
     "multiuser_mode",
     "mnt_ns",
-    "magiskhide"
+    "denylist"
 };
 
 // Settings key indices
@@ -46,7 +46,7 @@ enum {
     ROOT_ACCESS = 0,
     SU_MULTIUSER_MODE,
     SU_MNT_NS,
-    HIDE_CONFIG
+    DENYLIST_CONFIG
 };
 
 // Values for root_access

native/jni/include/magisk.hpp

@@ -27,7 +27,7 @@ extern std::string  MAGISKTMP;
 #define SHELLPTS    INTLROOT "/pts"
 #define ROOTMNT     ROOTOVL "/.mount_list"
 
-constexpr const char *applet_names[] = { "su", "resetprop", "magiskhide", nullptr };
+constexpr const char *applet_names[] = { "su", "resetprop", nullptr };
 constexpr const char *init_applet[] = { "magiskpolicy", "supolicy", nullptr };
 
 #define POST_FS_DATA_WAIT_TIME       40
@@ -38,7 +38,6 @@ extern int SDK_INT;
 
 // Multi-call entrypoints
 int magisk_main(int argc, char *argv[]);
-int magiskhide_main(int argc, char *argv[]);
 int magiskpolicy_main(int argc, char *argv[]);
 int su_client_main(int argc, char *argv[]);
 int resetprop_main(int argc, char *argv[]);

native/jni/magiskhide/magiskhide.cpp

@@ -1,158 +0,0 @@
-#include <sys/wait.h>
-#include <sys/mount.h>
-
-#include <utils.hpp>
-
-#include "magiskhide.hpp"
-
-using namespace std;
-
-[[noreturn]] static void usage(char *arg0) {
-    fprintf(stderr,
-        "MagiskHide - Hide Config CLI\n\n"
-        "Usage: %s [action [arguments...] ]\n\n"
-        "Actions:\n"
-        "   status          Return the status of magiskhide\n"
-        "   enable          Start magiskhide\n"
-        "   disable         Stop magiskhide\n"
-        "   add PKG [PROC]  Add a new target to the hide list\n"
-        "   rm PKG [PROC]   Remove target(s) from the hide list\n"
-        "   ls              Print the current hide list\n"
-        "   exec CMDs...    Execute commands in isolated mount\n"
-        "                   namespace and do all hide unmounts\n"
-        , arg0);
-    exit(1);
-}
-
-void magiskhide_handler(int client, ucred *cred) {
-    if (client < 0) {
-        hide_unmount();
-        return;
-    }
-
-    int req = read_int(client);
-    int res = DAEMON_ERROR;
-
-    switch (req) {
-    case DISABLE_HIDE:
-    case ADD_LIST:
-    case RM_LIST:
-    case LS_LIST:
-        if (!hide_enabled()) {
-            write_int(client, HIDE_NOT_ENABLED);
-            close(client);
-            return;
-        }
-    }
-
-    switch (req) {
-    case ENABLE_HIDE:
-        res = enable_hide();
-        break;
-    case DISABLE_HIDE:
-        res = disable_hide();
-        break;
-    case ADD_LIST:
-        res = add_list(client);
-        break;
-    case RM_LIST:
-        res = rm_list(client);
-        break;
-    case LS_LIST:
-        ls_list(client);
-        return;
-    case HIDE_STATUS:
-        res = hide_enabled() ? HIDE_IS_ENABLED : HIDE_NOT_ENABLED;
-        break;
-    }
-
-    write_int(client, res);
-    close(client);
-}
-
-int magiskhide_main(int argc, char *argv[]) {
-    if (argc < 2)
-        usage(argv[0]);
-
-    // CLI backwards compatibility
-    const char *opt = argv[1];
-    if (opt[0] == '-' && opt[1] == '-')
-        opt += 2;
-
-    int req;
-    if (opt == "enable"sv)
-        req = ENABLE_HIDE;
-    else if (opt == "disable"sv)
-        req = DISABLE_HIDE;
-    else if (opt == "add"sv)
-        req = ADD_LIST;
-    else if (opt == "rm"sv)
-        req = RM_LIST;
-    else if (opt == "ls"sv)
-        req = LS_LIST;
-    else if (opt == "status"sv)
-        req = HIDE_STATUS;
-    else if (opt == "exec"sv && argc > 2) {
-        xunshare(CLONE_NEWNS);
-        xmount(nullptr, "/", nullptr, MS_PRIVATE | MS_REC, nullptr);
-        hide_unmount();
-        execvp(argv[2], argv + 2);
-        exit(1);
-    } else {
-        usage(argv[0]);
-    }
-
-    // Send request
-    int fd = connect_daemon();
-    write_int(fd, MAGISKHIDE);
-    write_int(fd, req);
-    if (req == ADD_LIST || req == RM_LIST) {
-        write_string(fd, argv[2]);
-        write_string(fd, argv[3] ? argv[3] : "");
-    }
-
-    // Get response
-    int code = read_int(fd);
-    switch (code) {
-    case DAEMON_SUCCESS:
-        break;
-    case HIDE_NOT_ENABLED:
-        fprintf(stderr, "MagiskHide is not enabled\n");
-        goto return_code;
-    case HIDE_IS_ENABLED:
-        fprintf(stderr, "MagiskHide is enabled\n");
-        goto return_code;
-    case HIDE_ITEM_EXIST:
-        fprintf(stderr, "Target already exists in hide list\n");
-        goto return_code;
-    case HIDE_ITEM_NOT_EXIST:
-        fprintf(stderr, "Target does not exist in hide list\n");
-        goto return_code;
-    case HIDE_NO_NS:
-        fprintf(stderr, "Your kernel doesn't support mount namespace\n");
-        goto return_code;
-    case HIDE_INVALID_PKG:
-        fprintf(stderr, "Invalid package / process name\n");
-        goto return_code;
-    case ROOT_REQUIRED:
-        fprintf(stderr, "Root is required for this operation\n");
-        goto return_code;
-    case DAEMON_ERROR:
-    default:
-        fprintf(stderr, "Daemon error\n");
-        return DAEMON_ERROR;
-    }
-
-    if (req == LS_LIST) {
-        string res;
-        for (;;) {
-            read_string(fd, res);
-            if (res.empty())
-                break;
-            printf("%s\n", res.data());
-        }
-    }
-
-return_code:
-    return req == HIDE_STATUS ? (code == HIDE_IS_ENABLED ? 0 : 1) : code != DAEMON_SUCCESS;
-}

native/jni/magiskhide/magiskhide.hpp

@@ -1,43 +0,0 @@
-#pragma once
-
-#include <pthread.h>
-#include <string_view>
-#include <functional>
-#include <map>
-
-#include <daemon.hpp>
-
-#define ISOLATED_MAGIC "isolated"
-
-// CLI entries
-int enable_hide();
-int disable_hide();
-int add_list(int client);
-int rm_list(int client);
-void ls_list(int client);
-
-// Utility functions
-bool hide_enabled();
-bool is_hide_target(int uid, std::string_view process);
-
-// Hide policies
-void hide_daemon(int pid, int client);
-void hide_unmount(int pid = -1);
-
-enum {
-    ENABLE_HIDE,
-    DISABLE_HIDE,
-    ADD_LIST,
-    RM_LIST,
-    LS_LIST,
-    HIDE_STATUS,
-};
-
-enum {
-    HIDE_IS_ENABLED = DAEMON_LAST,
-    HIDE_NOT_ENABLED,
-    HIDE_ITEM_EXIST,
-    HIDE_ITEM_NOT_EXIST,
-    HIDE_NO_NS,
-    HIDE_INVALID_PKG
-};

native/jni/zygisk/entry.cpp

@@ -10,7 +10,7 @@
 #include <magisk.hpp>
 
 #include "inject.hpp"
-#include "../magiskhide/magiskhide.hpp"
+#include "../deny/deny.hpp"
 
 using namespace std;
 
@@ -255,22 +255,22 @@ static void setup_files(int client, ucred *cred) {
 }
 
 static void check_denylist(int client) {
-    if (!hide_enabled()) {
-        write_int(client, HIDE_NOT_ENABLED);
+    if (!deny_enforced()) {
+        write_int(client, DENY_NOT_ENFORCED);
         return;
     }
     write_int(client, 0);
     int uid = read_int(client);
     string process = read_string(client);
-    write_int(client, is_hide_target(uid, process));
+    write_int(client, is_deny_target(uid, process));
 }
 
 static void do_unmount(int client, ucred *cred) {
-    LOGD("zygisk: cleanup mount namespace for pid=[%d]\n", cred->pid);
-    if (hide_enabled()) {
-        hide_daemon(cred->pid, client);
+    if (deny_enforced()) {
+        LOGD("zygisk: cleanup mount namespace for pid=[%d]\n", cred->pid);
+        revert_daemon(cred->pid, client);
     } else {
-        write_int(client, HIDE_NOT_ENABLED);
+        write_int(client, DENY_NOT_ENFORCED);
     }
 }