Release Magisk v27.0

https://github.blog/changelog/2024-01-30-github-actions-introducing-the-new-m1-macos-runner-available-to-open-source/

.github/actions/setup/action.yml

@@ -0,0 +1,44 @@
+name: Magisk Setup
+runs:
+  using: "composite"
+  steps:
+    - name: Set up JDK 17
+      uses: actions/setup-java@v4
+      with:
+        distribution: "temurin"
+        java-version: "17"
+
+    - name: Set up Python 3
+      uses: actions/setup-python@v5
+      with:
+        python-version: "3.x"
+
+    - name: Set up sccache
+      uses: hendrikmuhs/ccache-action@v1.2
+      with:
+        variant: sccache
+        key: ${{ runner.os }}-${{ github.sha }}
+        restore-keys: ${{ runner.os }}
+        max-size: 10000M
+
+    - name: Cache Gradle dependencies
+      uses: actions/cache@v4
+      with:
+        path: |
+          ~/.gradle/caches
+          ~/.gradle/wrapper
+          !~/.gradle/caches/build-cache-*
+        key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle.kts') }}
+        restore-keys: ${{ runner.os }}-gradle-
+
+    - name: Cache build cache
+      uses: actions/cache@v4
+      with:
+        path: |
+          ~/.gradle/caches/build-cache-*
+        key: ${{ runner.os }}-build-cache-${{ github.sha }}
+        restore-keys: ${{ runner.os }}-build-cache-
+
+    - name: Set up NDK
+      run: python build.py -v ndk
+      shell: bash

.github/workflows/build.yml

@@ -17,118 +17,101 @@ on:
 
 jobs:
   build:
-    name: Build on ${{ matrix.os }}
-    runs-on: ${{ matrix.os }}
+    name: Build Magisk artifacts
+    runs-on: ubuntu-latest
+    env:
+      SCCACHE_DIRECT: false
     strategy:
       fail-fast: false
-      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest]
     steps:
       - name: Check out
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           submodules: "recursive"
           fetch-depth: 0
 
-      - name: Set up JDK 17
-        uses: actions/setup-java@v3
-        with:
-          distribution: "temurin"
-          java-version: "17"
-
-      - name: Set up Python 3
-        uses: actions/setup-python@v4
-        with:
-          python-version: "3.x"
-
-      - name: Set up sccache
-        uses: hendrikmuhs/ccache-action@v1.2
-        with:
-          variant: sccache
-          key: ${{ runner.os }}-${{ github.sha }}
-          restore-keys: ${{ runner.os }}
-          max-size: 10000M
-
-      - name: Cache Gradle dependencies
-        uses: actions/cache@v3
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-            !~/.gradle/caches/build-cache-*
-          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle.kts') }}
-          restore-keys: ${{ runner.os }}-gradle-
-
-      - name: Cache build cache
-        uses: actions/cache@v3
-        with:
-          path: |
-            ~/.gradle/caches/build-cache-*
-          key: ${{ runner.os }}-build-cache-${{ github.sha }}
-          restore-keys: ${{ runner.os }}-build-cache-
-
-      - name: Set up NDK
-        run: python build.py -v ndk
+      - name: Setup environment
+        uses: ./.github/actions/setup
 
       - name: Build release
-        run: |
-          python build.py -vr all
+        run: ./build.py -vr all
 
       - name: Build debug
-        run: |
-          python build.py -v all
+        run: ./build.py -v all
 
       - name: Stop gradle daemon
         run: ./gradlew --stop
 
-      # Only upload artifacts built on Linux
       - name: Upload build artifact
-        if: runner.os == 'Linux'
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: ${{ github.sha }}
           path: out
+          compression-level: 9
 
       - name: Upload mapping and native debug symbols
-        if: runner.os == 'Linux'
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: ${{ github.sha }}-symbols
           path: app/build/outputs
+          compression-level: 9
+
+  test-build:
+    name: Test building on ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    env:
+      SCCACHE_DIRECT: false
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [windows-latest, macos-14]
+    steps:
+      - name: Check out
+        uses: actions/checkout@v4
+        with:
+          submodules: "recursive"
+          fetch-depth: 0
+
+      - name: Setup environment
+        uses: ./.github/actions/setup
+
+      - name: Build debug
+        run: python build.py -v all
+
+      - name: Stop gradle daemon
+        run: ./gradlew --stop
 
   test:
-    name: Test on ${{ matrix.api }}
-    runs-on: macos-latest
+    name: Test on API ${{ matrix.api }}
+    runs-on: ubuntu-latest
     needs: build
     strategy:
       fail-fast: false
       matrix:
-        api: [23, 26, 28, 29, 34]
+        api: [23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34]
 
     steps:
       - name: Check out
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
-      - name: Set up JDK 17
-        uses: actions/setup-java@v3
-        with:
-          distribution: "temurin"
-          java-version: "17"
-
       - name: Set up Python 3
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v5
         with:
           python-version: "3.x"
 
       - name: Download build artifacts
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         with:
           name: ${{ github.sha }}
           path: out
 
-      - name: AVD test
+      - name: Enable KVM group perms
         run: |
-          brew install coreutils
-          scripts/avd_test.sh ${{ matrix.api }}
+          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
+          sudo udevadm control --reload-rules
+          sudo udevadm trigger --name-match=kvm
+
+      - name: AVD test
+        run: scripts/avd_test.sh ${{ matrix.api }}

.gitmodules

@@ -4,9 +4,6 @@
 [submodule "busybox"]
 	path = native/src/external/busybox
 	url = https://github.com/topjohnwu/ndk-busybox.git
-[submodule "dtc"]
-	path = native/src/external/dtc
-	url = https://github.com/dgibson/dtc.git
 [submodule "lz4"]
 	path = native/src/external/lz4
 	url = https://github.com/lz4/lz4.git
@@ -16,9 +13,6 @@
 [submodule "xz"]
 	path = native/src/external/xz
 	url = https://github.com/xz-mirror/xz.git
-[submodule "nanopb"]
-	path = native/src/external/nanopb
-	url = https://github.com/nanopb/nanopb.git
 [submodule "pcre"]
 	path = native/src/external/pcre
 	url = https://android.googlesource.com/platform/external/pcre
@@ -28,9 +22,6 @@
 [submodule "zlib"]
 	path = native/src/external/zlib
 	url = https://android.googlesource.com/platform/external/zlib
-[submodule "parallel-hashmap"]
-	path = native/src/external/parallel-hashmap
-	url = https://github.com/greg7mdp/parallel-hashmap.git
 [submodule "zopfli"]
 	path = native/src/external/zopfli
 	url = https://github.com/google/zopfli.git

README.MD

@@ -18,8 +18,8 @@ Some highlight features:
 
 [Github](https://github.com/topjohnwu/Magisk/) is the only source where you can get official Magisk information and downloads.
 
-[![](https://img.shields.io/badge/Magisk-v26.1-blue)](https://github.com/topjohnwu/Magisk/releases/tag/v26.1)
-[![](https://img.shields.io/badge/Magisk%20Beta-v26.2-blue)](https://github.com/topjohnwu/Magisk/releases/tag/v26.2)
+[![](https://img.shields.io/badge/Magisk-v26.4-blue)](https://github.com/topjohnwu/Magisk/releases/tag/v26.4)
+[![](https://img.shields.io/badge/Magisk%20Beta-v26.4-blue)](https://github.com/topjohnwu/Magisk/releases/tag/v26.4)
 [![](https://img.shields.io/badge/Magisk-Canary-red)](https://raw.githubusercontent.com/topjohnwu/magisk-files/canary/app-release.apk)
 [![](https://img.shields.io/badge/Magisk-Debug-red)](https://raw.githubusercontent.com/topjohnwu/magisk-files/canary/app-debug.apk)
 

app/build.gradle.kts

@@ -74,13 +74,13 @@ dependencies {
     implementation("com.github.topjohnwu:indeterminate-checkbox:1.0.7")
     implementation("com.github.topjohnwu:lz4-java:1.7.1")
     implementation("com.jakewharton.timber:timber:5.0.1")
-    implementation("org.bouncycastle:bcpkix-jdk18on:1.76")
+    implementation("org.bouncycastle:bcpkix-jdk18on:1.77")
     implementation("dev.rikka.rikkax.layoutinflater:layoutinflater:1.3.0")
     implementation("dev.rikka.rikkax.insets:insets:1.3.0")
     implementation("dev.rikka.rikkax.recyclerview:recyclerview-ktx:1.3.2")
     implementation("io.noties.markwon:core:4.6.2")
 
-    val vLibsu = "5.2.1"
+    val vLibsu = "5.2.2"
     implementation("com.github.topjohnwu.libsu:core:${vLibsu}")
     implementation("com.github.topjohnwu.libsu:service:${vLibsu}")
     implementation("com.github.topjohnwu.libsu:nio:${vLibsu}")
@@ -90,7 +90,7 @@ dependencies {
     implementation("com.squareup.retrofit2:converter-moshi:${vRetrofit}")
     implementation("com.squareup.retrofit2:converter-scalars:${vRetrofit}")
 
-    val vOkHttp = "4.11.0"
+    val vOkHttp = "4.12.0"
     implementation("com.squareup.okhttp3:okhttp:${vOkHttp}")
     implementation("com.squareup.okhttp3:logging-interceptor:${vOkHttp}")
     implementation("com.squareup.okhttp3:okhttp-dnsoverhttps:${vOkHttp}")
@@ -99,23 +99,23 @@ dependencies {
     implementation("com.squareup.moshi:moshi:${vMoshi}")
     kapt("com.squareup.moshi:moshi-kotlin-codegen:${vMoshi}")
 
-    val vRoom = "2.6.0-beta01"
+    val vRoom = "2.6.1"
     implementation("androidx.room:room-runtime:${vRoom}")
     implementation("androidx.room:room-ktx:${vRoom}")
     kapt("androidx.room:room-compiler:${vRoom}")
 
-    val vNav = "2.7.1"
+    val vNav = "2.7.6"
     implementation("androidx.navigation:navigation-fragment-ktx:${vNav}")
     implementation("androidx.navigation:navigation-ui-ktx:${vNav}")
 
-    implementation("androidx.biometric:biometric:1.1.0")
     implementation("androidx.constraintlayout:constraintlayout:2.1.4")
     implementation("androidx.swiperefreshlayout:swiperefreshlayout:1.1.0")
     implementation("androidx.appcompat:appcompat:1.6.1")
-    implementation("androidx.recyclerview:recyclerview:1.3.1")
-    implementation("androidx.fragment:fragment-ktx:1.6.1")
+    implementation("androidx.recyclerview:recyclerview:1.3.2")
+    implementation("androidx.fragment:fragment-ktx:1.6.2")
     implementation("androidx.transition:transition:1.4.1")
-    implementation("androidx.core:core-ktx:1.10.1")
+    implementation("androidx.core:core-ktx:1.12.0")
     implementation("androidx.core:core-splashscreen:1.0.1")
-    implementation("com.google.android.material:material:1.9.0")
+    implementation("androidx.profileinstaller:profileinstaller:1.3.1")
+    implementation("com.google.android.material:material:1.11.0")
 }

app/src/main/AndroidManifest.xml

@@ -82,11 +82,15 @@
             android:name="androidx.room.MultiInstanceInvalidationService"
             tools:node="remove" />
 
-        <!-- We don't need emoji compat -->
+        <!-- We handle initialization ourselves -->
         <provider
             android:name="androidx.startup.InitializationProvider"
             android:authorities="${applicationId}.androidx-startup"
-            android:exported="false"
+            tools:node="remove" />
+
+        <!-- We handle profile installation ourselves  -->
+        <receiver
+            android:name="androidx.profileinstaller.ProfileInstallReceiver"
             tools:node="remove" />
 
     </application>

app/src/main/java/com/topjohnwu/magisk/core/App.kt

@@ -5,9 +5,12 @@ import android.app.Application
 import android.content.Context
 import android.content.res.Configuration
 import android.os.Bundle
+import androidx.profileinstaller.ProfileInstaller
+import com.topjohnwu.magisk.BuildConfig
 import com.topjohnwu.magisk.StubApk
 import com.topjohnwu.magisk.core.di.ServiceLocator
 import com.topjohnwu.magisk.core.utils.DispatcherExecutor
+import com.topjohnwu.magisk.core.utils.NetworkObserver
 import com.topjohnwu.magisk.core.utils.ProcessLifecycle
 import com.topjohnwu.magisk.core.utils.RootUtils
 import com.topjohnwu.magisk.core.utils.ShellInit
@@ -19,6 +22,8 @@ import com.topjohnwu.superuser.Shell
 import com.topjohnwu.superuser.internal.UiThreadHandler
 import com.topjohnwu.superuser.ipc.RootService
 import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.GlobalScope
+import kotlinx.coroutines.launch
 import timber.log.Timber
 import java.lang.ref.WeakReference
 import kotlin.system.exitProcess
@@ -82,6 +87,12 @@ open class App() : Application() {
     override fun onCreate() {
         super.onCreate()
         ProcessLifecycle.init(this)
+        NetworkObserver.init(this)
+        if (!BuildConfig.DEBUG && !isRunningAsStub) {
+            GlobalScope.launch(Dispatchers.IO) {
+                ProfileInstaller.writeProfile(this@App)
+            }
+        }
     }
 
     override fun onConfigurationChanged(newConfig: Configuration) {

app/src/main/java/com/topjohnwu/magisk/core/Config.kt

@@ -156,7 +156,12 @@ object Config : PreferenceConfig, DBConfig {
     var rootMode by dbSettings(Key.ROOT_ACCESS, Value.ROOT_ACCESS_APPS_AND_ADB)
     var suMntNamespaceMode by dbSettings(Key.SU_MNT_NS, Value.NAMESPACE_MODE_REQUESTER)
     var suMultiuserMode by dbSettings(Key.SU_MULTIUSER_MODE, Value.MULTIUSER_MODE_OWNER_ONLY)
-    var suBiometric by dbSettings(Key.SU_BIOMETRIC, false)
+    private var suBiometric by dbSettings(Key.SU_BIOMETRIC, false)
+    var userAuth
+        get() = Info.isDeviceSecure && suBiometric
+        set(value) {
+            suBiometric = value
+        }
     var zygisk by dbSettings(Key.ZYGISK, false)
     var denyList by BoolDBPropertyNoWrite(Key.DENYLIST, false)
     var suManager by dbStrings(Key.SU_MANAGER, "", true)

app/src/main/java/com/topjohnwu/magisk/core/Info.kt

@@ -1,13 +1,12 @@
 package com.topjohnwu.magisk.core
 
-import androidx.lifecycle.LiveData
+import android.app.KeyguardManager
 import androidx.lifecycle.MutableLiveData
 import com.topjohnwu.magisk.StubApk
 import com.topjohnwu.magisk.core.di.AppContext
 import com.topjohnwu.magisk.core.ktx.getProperty
 import com.topjohnwu.magisk.core.model.UpdateInfo
 import com.topjohnwu.magisk.core.repository.NetworkService
-import com.topjohnwu.magisk.core.utils.NetworkObserver
 import com.topjohnwu.superuser.ShellUtils.fastCmd
 
 val isRunningAsStub get() = Info.stub != null
@@ -42,20 +41,16 @@ object Info {
         getProperty("ro.kernel.qemu", "0") == "1" ||
             getProperty("ro.boot.qemu", "0") == "1"
 
-    val isConnected: LiveData<Boolean> by lazy {
-        MutableLiveData(false).also { field ->
-            NetworkObserver.observe(AppContext) {
-                remote = EMPTY_REMOTE
-                field.postValue(it)
-            }
-        }
-    }
+    val isConnected = MutableLiveData(false)
 
     val showSuperUser: Boolean get() {
         return env.isActive && (Const.USER_ID == 0
                 || Config.suMultiuserMode == Config.Value.MULTIUSER_MODE_USER)
     }
 
+    val isDeviceSecure get() =
+        AppContext.getSystemService(KeyguardManager::class.java).isDeviceSecure
+
     private fun loadState(): Env {
         val v = fastCmd("magisk -v").split(":".toRegex())
         return Env(

app/src/main/java/com/topjohnwu/magisk/core/Provider.kt

@@ -6,12 +6,18 @@ import android.os.ParcelFileDescriptor
 import android.os.ParcelFileDescriptor.MODE_READ_ONLY
 import com.topjohnwu.magisk.core.base.BaseProvider
 import com.topjohnwu.magisk.core.su.SuCallbackHandler
+import com.topjohnwu.magisk.core.su.TestHandler
 
 class Provider : BaseProvider() {
 
     override fun call(method: String, arg: String?, extras: Bundle?): Bundle? {
-        SuCallbackHandler.run(context!!, method, extras)
-        return Bundle.EMPTY
+        return when (method) {
+            SuCallbackHandler.LOG, SuCallbackHandler.NOTIFY -> {
+                SuCallbackHandler.run(context!!, method, extras)
+                Bundle.EMPTY
+            }
+            else -> TestHandler.run(method)
+        }
     }
 
     override fun openFile(uri: Uri, mode: String): ParcelFileDescriptor? {

app/src/main/java/com/topjohnwu/magisk/core/base/BaseActivity.kt

@@ -20,6 +20,7 @@ import com.topjohnwu.magisk.R
 import com.topjohnwu.magisk.core.isRunningAsStub
 import com.topjohnwu.magisk.core.ktx.reflectField
 import com.topjohnwu.magisk.core.ktx.toast
+import com.topjohnwu.magisk.core.utils.RequestAuthentication
 import com.topjohnwu.magisk.core.utils.RequestInstall
 import com.topjohnwu.magisk.core.wrap
 
@@ -43,6 +44,12 @@ abstract class BaseActivity : AppCompatActivity() {
         installCallback = null
     }
 
+    var authenticateCallback: ((Boolean) -> Unit)? = null
+    val requestAuthenticate = registerForActivityResult(RequestAuthentication()) {
+        authenticateCallback?.invoke(it)
+        authenticateCallback = null
+    }
+
     private var contentCallback: ContentResultCallback? = null
     private val getContent = registerForActivityResult(GetContent()) {
         if (it != null) contentCallback?.onActivityResult(it)

app/src/main/java/com/topjohnwu/magisk/core/di/ServiceLocator.kt

@@ -12,7 +12,6 @@ import com.topjohnwu.magisk.core.data.magiskdb.StringDao
 import com.topjohnwu.magisk.core.ktx.deviceProtectedContext
 import com.topjohnwu.magisk.core.repository.LogRepository
 import com.topjohnwu.magisk.core.repository.NetworkService
-import com.topjohnwu.magisk.core.utils.BiometricHelper
 import io.noties.markwon.Markwon
 import io.noties.markwon.utils.NoCopySpannableFactory
 
@@ -24,7 +23,6 @@ object ServiceLocator {
     lateinit var context: Context
     val deContext by lazy { context.deviceProtectedContext }
     val timeoutPrefs by lazy { deContext.getSharedPreferences("su_timeout", 0) }
-    val biometrics by lazy { BiometricHelper(context) }
 
     // Database
     val policyDB = PolicyDao()

app/src/main/java/com/topjohnwu/magisk/core/su/SuRequestHandler.kt

@@ -58,6 +58,7 @@ class SuRequestHandler(
         val pid = intent.getIntExtra("pid", -1)
         val fifo = intent.getStringExtra("fifo")
         if (uid <= 0 || pid <= 0 || fifo == null) {
+            Timber.e("Unexpected extras: uid=[${uid}], pid=[${pid}], fifo=[${fifo}]")
             return false
         }
         output = File(fifo)
@@ -73,7 +74,11 @@ class SuRequestHandler(
             respond(SuPolicy.DENY, -1)
             return false
         }
-        return output.canWrite()
+        if (!output.canWrite()) {
+            Timber.e("Cannot write to $output")
+            return false
+        }
+        return true
     }
 
     suspend fun respond(action: Int, time: Int) {

app/src/main/java/com/topjohnwu/magisk/core/su/TestHandler.kt

@@ -0,0 +1,68 @@
+package com.topjohnwu.magisk.core.su
+
+import android.os.Bundle
+import com.topjohnwu.magisk.core.Config
+import com.topjohnwu.magisk.core.Info
+import com.topjohnwu.magisk.core.di.ServiceLocator
+import com.topjohnwu.magisk.core.tasks.MagiskInstaller
+import com.topjohnwu.magisk.core.utils.RootUtils
+import com.topjohnwu.superuser.Shell
+import com.topjohnwu.superuser.internal.NOPList
+import kotlinx.coroutines.runBlocking
+
+object TestHandler {
+
+    fun run(method: String): Bundle {
+        val r = Bundle()
+
+        fun setup(): Boolean {
+            val nop = NOPList.getInstance()
+            return runBlocking {
+                MagiskInstaller.Emulator(nop, nop).exec()
+            }
+        }
+
+        fun test(): Boolean {
+            // Make sure Zygisk works correctly
+            if (!Info.isZygiskEnabled) {
+                r.putString("reason", "zygisk not enabled")
+                return false
+            }
+
+            // Make sure the Magisk app can get root
+            val shell = Shell.getShell()
+            if (!shell.isRoot) {
+                r.putString("reason", "shell not root")
+                return false
+            }
+
+            // Make sure the root service is running
+            RootUtils.Connection.await()
+
+            // Clear existing grant for ADB shell
+            runBlocking {
+                ServiceLocator.policyDB.delete(2000)
+                Config.suAutoResponse = Config.Value.SU_AUTO_ALLOW
+                Config.prefs.edit().commit()
+            }
+            return true
+        }
+
+        val b = runCatching {
+            when (method) {
+                "setup" -> setup()
+                "test" -> test()
+                else -> {
+                    r.putString("reason", "unknown method")
+                    false
+                }
+            }
+        }.getOrElse {
+            r.putString("reason", it.stackTraceToString())
+            false
+        }
+
+        r.putBoolean("result", b)
+        return r
+    }
+}

app/src/main/java/com/topjohnwu/magisk/core/tasks/MagiskInstaller.kt

@@ -181,8 +181,10 @@ abstract class MagiskInstallImpl protected constructor(
         return TarEntry(TarHeader.createHeader(name, size, 0, false, 420 /* 0644 */))
     }
 
-    private class LZ4InputStream(s: InputStream) : LZ4FrameInputStream(s) {
-        // Workaround bug in LZ4FrameInputStream
+    private class NoAvailableStream(s: InputStream) : FilterInputStream(s) {
+        // Make sure available is never called on the actual stream and always return 0
+        // 1. Workaround bug in LZ4FrameInputStream
+        // 2. Reduce max buffer size to prevent OOM
         override fun available() = 0
     }
 
@@ -194,7 +196,8 @@ abstract class MagiskInstallImpl protected constructor(
         lateinit var entry: TarEntry
 
         fun decompressedStream(): InputStream {
-            return if (entry.name.endsWith(".lz4")) LZ4InputStream(tarIn) else tarIn
+            val stream = if (entry.name.endsWith(".lz4")) LZ4FrameInputStream(tarIn) else tarIn
+            return NoAvailableStream(stream)
         }
 
         while (tarIn.nextEntry?.let { entry = it } != null) {

app/src/main/java/com/topjohnwu/magisk/core/utils/BiometricHelper.kt

@@ -1,53 +0,0 @@
-package com.topjohnwu.magisk.core.utils
-
-import android.content.Context
-import androidx.biometric.BiometricManager
-import androidx.biometric.BiometricManager.Authenticators
-import androidx.biometric.BiometricPrompt
-import androidx.core.content.ContextCompat
-import androidx.fragment.app.FragmentActivity
-import com.topjohnwu.magisk.R
-import com.topjohnwu.magisk.core.Config
-
-class BiometricHelper(context: Context) {
-
-    private val mgr = BiometricManager.from(context)
-
-    val isSupported get() = when (mgr.canAuthenticate(Authenticators.BIOMETRIC_WEAK)) {
-        BiometricManager.BIOMETRIC_SUCCESS -> true
-        else -> false
-    }
-
-    val isEnabled get() = isSupported && Config.suBiometric
-
-    fun authenticate(
-        activity: FragmentActivity,
-        onError: () -> Unit = {},
-        onSuccess: () -> Unit): BiometricPrompt {
-        val prompt = BiometricPrompt(activity,
-            ContextCompat.getMainExecutor(activity),
-            object : BiometricPrompt.AuthenticationCallback() {
-                override fun onAuthenticationError(errorCode: Int, errString: CharSequence) {
-                    onError()
-                }
-
-                override fun onAuthenticationFailed() {
-                    onError()
-                }
-
-                override fun onAuthenticationSucceeded(result: BiometricPrompt.AuthenticationResult) {
-                    onSuccess()
-                }
-            }
-        )
-        val info = BiometricPrompt.PromptInfo.Builder()
-            .setConfirmationRequired(true)
-            .setAllowedAuthenticators(Authenticators.BIOMETRIC_WEAK)
-            .setTitle(activity.getString(R.string.authenticate))
-            .setNegativeButtonText(activity.getString(android.R.string.cancel))
-            .build()
-        prompt.authenticate(info)
-        return prompt
-    }
-
-}

app/src/main/java/com/topjohnwu/magisk/core/utils/NetworkObserver.kt

@@ -14,14 +14,10 @@ import androidx.core.content.getSystemService
 import androidx.lifecycle.DefaultLifecycleObserver
 import androidx.lifecycle.LifecycleOwner
 import androidx.lifecycle.ProcessLifecycleOwner
+import com.topjohnwu.magisk.core.Info
 import com.topjohnwu.magisk.core.ktx.registerRuntimeReceiver
 
-typealias ConnectionCallback = (Boolean) -> Unit
-
-class NetworkObserver(
-    context: Context,
-    private val callback: ConnectionCallback
-): DefaultLifecycleObserver {
+class NetworkObserver(context: Context): DefaultLifecycleObserver {
     private val manager = context.getSystemService<ConnectivityManager>()!!
 
     private val networkCallback = object : ConnectivityManager.NetworkCallback() {
@@ -29,11 +25,11 @@ class NetworkObserver(
 
         override fun onAvailable(network: Network) {
             activeList.add(network)
-            callback(true)
+            postValue(true)
         }
         override fun onLost(network: Network) {
             activeList.remove(network)
-            callback(!activeList.isEmpty())
+            postValue(!activeList.isEmpty())
         }
     }
 
@@ -45,7 +41,7 @@ class NetworkObserver(
         }
         override fun onReceive(context: Context, intent: Intent) {
             if (context.isIdleMode()) {
-                callback(false)
+                postValue(false)
             } else {
                 postCurrentState()
             }
@@ -67,13 +63,18 @@ class NetworkObserver(
     }
 
     private fun postCurrentState() {
-        callback(manager.getNetworkCapabilities(manager.activeNetwork)
+        postValue(manager.getNetworkCapabilities(manager.activeNetwork)
             ?.hasCapability(NetworkCapabilities.NET_CAPABILITY_VALIDATED) ?: false)
     }
 
+    private fun postValue(b: Boolean) {
+        Info.remote = Info.EMPTY_REMOTE
+        Info.isConnected.postValue(b)
+    }
+
     companion object {
-        fun observe(context: Context, callback: ConnectionCallback): NetworkObserver {
-            return NetworkObserver(context, callback).apply { postCurrentState() }
+        fun init(context: Context): NetworkObserver {
+            return NetworkObserver(context).apply { postCurrentState() }
         }
     }
 }

app/src/main/java/com/topjohnwu/magisk/core/utils/RequestAuthentication.kt

@@ -0,0 +1,17 @@
+package com.topjohnwu.magisk.core.utils
+
+import android.app.Activity
+import android.app.KeyguardManager
+import android.content.Context
+import android.content.Intent
+import androidx.activity.result.contract.ActivityResultContract
+
+class RequestAuthentication: ActivityResultContract<Unit, Boolean>() {
+
+    override fun createIntent(context: Context, input: Unit) =
+        context.getSystemService(KeyguardManager::class.java)
+            .createConfirmDeviceCredentialIntent(null, null)
+
+    override fun parseResult(resultCode: Int, intent: Intent?) =
+        resultCode == Activity.RESULT_OK
+}

app/src/main/java/com/topjohnwu/magisk/events/BiometricEvent.kt

@@ -1,38 +0,0 @@
-package com.topjohnwu.magisk.events
-
-import com.topjohnwu.magisk.arch.ActivityExecutor
-import com.topjohnwu.magisk.arch.UIActivity
-import com.topjohnwu.magisk.arch.ViewEvent
-import com.topjohnwu.magisk.core.di.ServiceLocator
-
-class BiometricEvent(
-    builder: Builder.() -> Unit
-) : ViewEvent(), ActivityExecutor {
-
-    private var listenerOnFailure: () -> Unit = {}
-    private var listenerOnSuccess: () -> Unit = {}
-
-    init {
-        builder(Builder())
-    }
-
-    override fun invoke(activity: UIActivity<*>) {
-        ServiceLocator.biometrics.authenticate(
-            activity,
-            onError = listenerOnFailure,
-            onSuccess = listenerOnSuccess
-        )
-    }
-
-    inner class Builder internal constructor() {
-
-        fun onFailure(listener: () -> Unit) {
-            listenerOnFailure = listener
-        }
-
-        fun onSuccess(listener: () -> Unit) {
-            listenerOnSuccess = listener
-        }
-    }
-
-}

app/src/main/java/com/topjohnwu/magisk/events/ViewEvents.kt

@@ -51,6 +51,16 @@ class RecreateEvent : ViewEvent(), ActivityExecutor {
     }
 }
 
+class AuthEvent(
+    private val callback: () -> Unit
+) : ViewEvent(), ActivityExecutor {
+
+    override fun invoke(activity: UIActivity<*>) {
+        activity.authenticateCallback = { if (it) callback() }
+        activity.requestAuthenticate.launch(Unit)
+    }
+}
+
 class GetContentEvent(
     private val type: String,
     private val callback: ContentResultCallback

app/src/main/java/com/topjohnwu/magisk/ui/settings/SettingsItems.kt

@@ -12,7 +12,6 @@ import com.topjohnwu.magisk.R
 import com.topjohnwu.magisk.core.Config
 import com.topjohnwu.magisk.core.Const
 import com.topjohnwu.magisk.core.Info
-import com.topjohnwu.magisk.core.di.ServiceLocator
 import com.topjohnwu.magisk.core.ktx.activity
 import com.topjohnwu.magisk.core.tasks.HideAPK
 import com.topjohnwu.magisk.core.utils.MediaStoreUtils
@@ -283,19 +282,15 @@ object Tapjack : BaseSettingsItem.Toggle() {
     override var value by Config::suTapjack
 }
 
-object Biometrics : BaseSettingsItem.Toggle() {
-    override val title = R.string.settings_su_biometric_title.asText()
-    override var description = R.string.settings_su_biometric_summary.asText()
-    override var value
-        get() = ServiceLocator.biometrics.isEnabled
-        set(value) {
-            Config.suBiometric = value
-        }
+object Authentication : BaseSettingsItem.Toggle() {
+    override val title = R.string.settings_su_auth_title.asText()
+    override var description = R.string.settings_su_auth_summary.asText()
+    override var value by Config::userAuth
 
     override fun refresh() {
-        isEnabled = ServiceLocator.biometrics.isSupported
+        isEnabled = Info.isDeviceSecure
         if (!isEnabled) {
-            description = R.string.no_biometric.asText()
+            description = R.string.settings_su_auth_insecure.asText()
         }
     }
 }

app/src/main/java/com/topjohnwu/magisk/ui/settings/SettingsViewModel.kt

@@ -18,7 +18,7 @@ import com.topjohnwu.magisk.core.ktx.toast
 import com.topjohnwu.magisk.core.tasks.HideAPK
 import com.topjohnwu.magisk.databinding.bindExtra
 import com.topjohnwu.magisk.events.AddHomeIconEvent
-import com.topjohnwu.magisk.events.BiometricEvent
+import com.topjohnwu.magisk.events.AuthEvent
 import com.topjohnwu.magisk.events.SnackbarEvent
 import com.topjohnwu.superuser.Shell
 import kotlinx.coroutines.launch
@@ -72,7 +72,7 @@ class SettingsViewModel : BaseViewModel(), BaseSettingsItem.Handler {
         if (Info.showSuperUser) {
             list.addAll(listOf(
                 Superuser,
-                Tapjack, Biometrics, AccessMode, MultiuserMode, MountNamespaceMode,
+                Tapjack, Authentication, AccessMode, MultiuserMode, MountNamespaceMode,
                 AutomaticResponse, RequestTimeout, SUNotification
             ))
             if (Build.VERSION.SDK_INT < Build.VERSION_CODES.O) {
@@ -92,7 +92,7 @@ class SettingsViewModel : BaseViewModel(), BaseSettingsItem.Handler {
         when (item) {
             DownloadPath -> withExternalRW(andThen)
             UpdateChecker -> withPostNotificationPermission(andThen)
-            Biometrics -> authenticate(andThen)
+            Authentication -> AuthEvent(andThen).publish()
             Theme -> SettingsFragmentDirections.actionSettingsFragmentToThemeFragment().navigate()
             DenyListConfig -> SettingsFragmentDirections.actionSettingsFragmentToDenyFragment().navigate()
             SystemlessHosts -> createHosts()
@@ -119,13 +119,6 @@ class SettingsViewModel : BaseViewModel(), BaseSettingsItem.Handler {
         }
     }
 
-    private fun authenticate(callback: () -> Unit) {
-        BiometricEvent {
-            // allow the change on success
-            onSuccess { callback() }
-        }.publish()
-    }
-
     private fun createHosts() {
         Shell.cmd("add_hosts_module").submit {
             AppContext.toast(R.string.settings_hosts_toast, Toast.LENGTH_SHORT)

app/src/main/java/com/topjohnwu/magisk/ui/superuser/SuperuserViewModel.kt

@@ -10,16 +10,20 @@ import androidx.lifecycle.viewModelScope
 import com.topjohnwu.magisk.BR
 import com.topjohnwu.magisk.R
 import com.topjohnwu.magisk.arch.AsyncLoadViewModel
+import com.topjohnwu.magisk.core.Config
 import com.topjohnwu.magisk.core.Info
 import com.topjohnwu.magisk.core.data.magiskdb.PolicyDao
 import com.topjohnwu.magisk.core.di.AppContext
-import com.topjohnwu.magisk.core.di.ServiceLocator
 import com.topjohnwu.magisk.core.ktx.getLabel
 import com.topjohnwu.magisk.core.model.su.SuPolicy
 import com.topjohnwu.magisk.core.utils.currentLocale
-import com.topjohnwu.magisk.databinding.*
+import com.topjohnwu.magisk.databinding.MergeObservableList
+import com.topjohnwu.magisk.databinding.RvItem
+import com.topjohnwu.magisk.databinding.bindExtra
+import com.topjohnwu.magisk.databinding.diffList
+import com.topjohnwu.magisk.databinding.set
 import com.topjohnwu.magisk.dialog.SuperuserRevokeDialog
-import com.topjohnwu.magisk.events.BiometricEvent
+import com.topjohnwu.magisk.events.AuthEvent
 import com.topjohnwu.magisk.events.SnackbarEvent
 import com.topjohnwu.magisk.utils.asText
 import com.topjohnwu.magisk.view.TextItem
@@ -113,10 +117,8 @@ class SuperuserViewModel(
             }
         }
 
-        if (ServiceLocator.biometrics.isEnabled) {
-            BiometricEvent {
-                onSuccess { updateState() }
-            }.publish()
+        if (Config.userAuth) {
+            AuthEvent { updateState() }.publish()
         } else {
             SuperuserRevokeDialog(item.title) { updateState() }.show()
         }
@@ -168,10 +170,8 @@ class SuperuserViewModel(
             }
         }
 
-        if (ServiceLocator.biometrics.isEnabled) {
-            BiometricEvent {
-                onSuccess { updateState() }
-            }.publish()
+        if (Config.userAuth) {
+            AuthEvent { updateState() }.publish()
         } else {
             updateState()
         }

app/src/main/java/com/topjohnwu/magisk/ui/surequest/SuRequestViewModel.kt

@@ -22,14 +22,13 @@ import com.topjohnwu.magisk.arch.BaseViewModel
 import com.topjohnwu.magisk.core.Config
 import com.topjohnwu.magisk.core.data.magiskdb.PolicyDao
 import com.topjohnwu.magisk.core.di.AppContext
-import com.topjohnwu.magisk.core.di.ServiceLocator
 import com.topjohnwu.magisk.core.ktx.getLabel
 import com.topjohnwu.magisk.core.ktx.toast
 import com.topjohnwu.magisk.core.model.su.SuPolicy.Companion.ALLOW
 import com.topjohnwu.magisk.core.model.su.SuPolicy.Companion.DENY
 import com.topjohnwu.magisk.core.su.SuRequestHandler
 import com.topjohnwu.magisk.databinding.set
-import com.topjohnwu.magisk.events.BiometricEvent
+import com.topjohnwu.magisk.events.AuthEvent
 import com.topjohnwu.magisk.events.DieEvent
 import com.topjohnwu.magisk.events.ShowUIEvent
 import com.topjohnwu.magisk.utils.TextHolder
@@ -77,12 +76,8 @@ class SuRequestViewModel(
 
     fun grantPressed() {
         cancelTimer()
-        if (ServiceLocator.biometrics.isEnabled) {
-            BiometricEvent {
-                onSuccess {
-                    respond(ALLOW)
-                }
-            }.publish()
+        if (Config.userAuth) {
+            AuthEvent { respond(ALLOW) }.publish()
         } else {
             respond(ALLOW)
         }

app/src/main/res/raw/manager.sh

@@ -195,6 +195,9 @@ mount_partitions() {
   # Check whether non rootfs root dir exists
   SYSTEM_AS_ROOT=false
   grep ' / ' /proc/mounts | grep -qv 'rootfs' && SYSTEM_AS_ROOT=true
+
+  LEGACYSAR=false
+  grep ' / ' /proc/mounts | grep -q '/dev/root' && LEGACYSAR=true
 }
 
 get_flags() {
@@ -210,15 +213,6 @@ get_flags() {
     PATCHVBMETAFLAG=true
   fi
   [ -z $RECOVERYMODE ] && RECOVERYMODE=false
-  if $SYSTEM_AS_ROOT; then
-    if grep ' / ' /proc/mounts | grep -q '/dev/root'; then
-      LEGACYSAR=true
-    else
-      LEGACYSAR=false
-    fi
-  else
-    LEGACYSAR=false
-  fi
 }
 
 run_migrations() { return; }
@@ -231,9 +225,9 @@ grep_prop() { return; }
 
 app_init() {
   mount_partitions
-  get_flags
   RAMDISKEXIST=false
   check_boot_ramdisk && RAMDISKEXIST=true
+  get_flags
   run_migrations
   SHA1=$(grep_prop SHA1 $MAGISKTMP/.magisk/config)
   check_encryption

app/src/main/res/values-ar/strings.xml

@@ -142,9 +142,6 @@
     <string name="superuser_notification">إشعارات طلبات الروت</string>
     <string name="settings_su_reauth_title">إعادة المصادقة بعد الترقية</string>
     <string name="settings_su_reauth_summary">أعد مصادقة صلاحيات الروت بعد إجراء ترقيات للتطبيق</string>
-    <string name="settings_su_biometric_title">تفعيل التحقق بالبصمة</string>
-    <string name="settings_su_biometric_summary">تحقق إضافي بالبصمة لطلبات الروت </string>
-    <string name="no_biometric">جهازك غير مدعوم، أو أنك لم تضبّط البصماتَ بجهازك</string>
     <string name="settings_customization">تخصيص</string>
 
     <string name="multiuser_mode">نمط مستخدمين متعددين</string>

app/src/main/res/values-ast/strings.xml

@@ -155,9 +155,6 @@
     <string name="settings_su_reauth_summary">Vuelve pidir los permisos de superusuariu dempués d\'anovar les aplicaciones</string>
     <string name="settings_su_tapjack_title">Proteición escontra\'l tapjacking</string>
     <string name="settings_su_tapjack_summary">El diálogu de concesión de permisos de superusuariu nun respuende a la entrada mentanto lu torgue otra ventana o superposición</string>
-    <string name="settings_su_biometric_title">Autenticación biométrica</string>
-    <string name="settings_su_biometric_summary">Usa l\'autenticación biométrica pa permitir les solicitúes de superusuariu</string>
-    <string name="no_biometric">El preséu nun ye compatible o nun s\'activaron los axustes biométricos</string>
     <string name="settings_customization">Personalización</string>
     <string name="setting_add_shortcut_summary">Amiesta un atayu a la pantalla d\'aniciu en casu de que\'l nome y l\'iconu seyan difíciles de reconocer darréu d\'anubrir l\'aplicación</string>
     <string name="settings_doh_title">DNS per HTTPS</string>

app/src/main/res/values-az/strings.xml

@@ -165,9 +165,6 @@
     <string name="settings_su_reauth_summary">Tətbiqləri yüksəltdikdən sonra Superuser icazəsi istə</string>
     <string name="settings_su_tapjack_title">Tapjack Qoruması</string>
     <string name="settings_su_tapjack_summary">Superuser icazə pəncərəsi digər pəncərələr tərəfindən əngəlləndikdə heçbir girişə cavab verməyəcək</string>
-    <string name="settings_su_biometric_title">Biometrik İcazə</string>
-    <string name="settings_su_biometric_summary">Superuser istəkləri üçün biometrik icazədən istifadə et</string>
-    <string name="no_biometric">Cihaz ya dəstəklənmir ya da biometrik ayarlar yoxdur</string>
     <string name="settings_customization">Özəlləşdirmə</string>
     <string name="setting_add_shortcut_summary">Tətbiqi gizlətdikdən sonra tapmaq çətin olmasın deyə ana ekrana qısayol əlavə et</string>
     <string name="settings_doh_title">HTTPS əvəzinə DNS</string>

app/src/main/res/values-be/strings.xml

@@ -142,9 +142,6 @@
     <string name="settings_su_reauth_summary">Паўторна запытваць правы суперкарыстальніка пасля абнаўлення праграмы</string>
     <string name="settings_su_tapjack_title">Уключыць абарону ад перахоплівання ўводу</string>
     <string name="settings_su_tapjack_summary">Дыялог выдачы правоў суперкарыстальніка не будзе адказваць на ўвод, калі па-над ім знаходзяцца іншыя вокны</string>
-    <string name="settings_su_biometric_title">Уключыць біяметрычную аўтэнтыфікацыю</string>
-    <string name="settings_su_biometric_summary">Выкарыстанне біяметрычнай аўтэнтыфікацыі для запытаў правоў суперкарыстальніка</string>
-    <string name="no_biometric">Не падтрымліваецца прыладай альбо не ўключана ў наладах</string>
     <string name="settings_customization">Персаналізацыя</string>
     <string name="setting_add_shortcut_summary">Дадаць на хатні экран прыгожы цэтлік на той выпадак, калі пасля хавання праграмы будзе цяжка разглядзець значок і назву</string>
     <string name="settings_doh_title">DNS паверх HTTPS</string>

app/src/main/res/values-bg/strings.xml

@@ -167,9 +167,6 @@
     <string name="settings_su_reauth_summary">Повторно запитване за достъп до правата на суперпотребителя след обновяване на приложения</string>
     <string name="settings_su_tapjack_title">Предпазване от измамно докосване</string>
     <string name="settings_su_tapjack_summary">Прозорецът за достъп до суперпотребителя няма да реагира, докато е покрит от друг прозорец или слой</string>
-    <string name="settings_su_biometric_title">Биометрично удостоверяване</string>
-    <string name="settings_su_biometric_summary">За получаване на достъп до суперпотребителя е необходимо биометрично удостоверяване</string>
-    <string name="no_biometric">Устройството не се поддръжа или липсват биометрични настройки</string>
     <string name="settings_customization">Приспособяване</string>
     <string name="setting_add_shortcut_summary">Добавя красив пряк път на началния екран ако името или текущата икона на скритото приложение са трудни за разпознаване</string>
     <string name="settings_doh_title">DNS през HTTPS</string>

app/src/main/res/values-bn/strings.xml

@@ -164,9 +164,6 @@
     <string name="settings_su_reauth_summary">অ্যাপগুলি আপগ্রেড করার পরে আবার সুপার ইউজার অনুমতির জন্য জিজ্ঞাসা করুন</string>
     <string name="settings_su_tapjack_title">ট্যাপজ্যাকিং সুরক্ষা</string>
     <string name="settings_su_tapjack_summary">সুপার ইউজার প্রম্পট ডায়ালগ অন্য কোনো উইন্ডো বা ওভারলে দ্বারা অস্পষ্ট থাকাকালীন ইনপুটটিতে সাড়া দেবে না</string>
-    <string name="settings_su_biometric_title">বায়োমেট্রিক প্রমাণীকরণ</string>
-    <string name="settings_su_biometric_summary">সুপার ইউজার অনুরোধের অনুমতি দিতে বায়োমেট্রিক প্রমাণীকরণ ব্যবহার করুন</string>
-    <string name="no_biometric">অসমর্থিত ডিভাইস বা কোনো বায়োমেট্রিক সেটিংস সক্ষম করা নেই৷</string>
     <string name="settings_customization">কাস্টমাইজেশন</string>
     <string name="setting_add_shortcut_summary">অ্যাপটি লুকানোর পরে নাম এবং আইকন সনাক্ত করা কঠিন হলে হোম স্ক্রিনে একটি সুন্দর শর্টকাট যোগ করুন</string>
     <string name="settings_doh_title">HTTPS এর উপর ডিএনএস</string>

app/src/main/res/values-ca/strings.xml

@@ -152,9 +152,6 @@
     <string name="settings_su_reauth_summary">Demanar permisos de superusuari novament si una aplicació és actualitzada o reinstal·lada</string>
     <string name="settings_su_tapjack_title">Activa la protecció contra \'TapJacking\'</string>
     <string name="settings_su_tapjack_summary">El diàleg per donar permisos de superusuari no respondrà mentre estigui ofuscat per alguna altra finestra o superposició</string>
-    <string name="settings_su_biometric_title">Activar autenticació biomètrica</string>
-    <string name="settings_su_biometric_summary">Utilitza l\'autenticació biomètrica per permetre sol·licituds de superusuari</string>
-    <string name="no_biometric">El dispositiu no suporta o no té establerta configuració biomètrica</string>
     <string name="settings_customization">Personalització</string>
     <string name="setting_add_shortcut_summary">Afegeix una bonica drecera a la pantalla d\'inici en cas que el nom i la icona siguin difícils de reconèixer després d\'amagar l\'aplicació.</string>
     <string name="settings_doh_title">DNS sobre HTTPS</string>

app/src/main/res/values-cs/strings.xml

@@ -170,9 +170,6 @@
     <string name="settings_su_reauth_summary">Opětovné ověření oprávnění SuperUser po aktualizaci aplikace.</string>
     <string name="settings_su_tapjack_title">Povolit ochranu před TapJack</string>
     <string name="settings_su_tapjack_summary">Okno dialogu SuperUser nebude reagovat na kliknutí v případě, že je zavřené nebo překryté jiným oknem</string>
-    <string name="settings_su_biometric_title">Povolit biometrické ověření</string>
-    <string name="settings_su_biometric_summary">Použije biometrické ověření pro povolení požadavků SuperUser</string>
-    <string name="no_biometric">Nepodporované zařízení, nebo není povolené biometrické ověření</string>
     <string name="settings_customization">Přizpůsobit</string>
     <string name="setting_add_shortcut_summary">Přidá odkaz na domovskou obrazovku v případě, že se po skrytí aplikace její název a ikona těžko rozpoznávají.</string>
     <string name="settings_doh_title">DNS přes HTTPS</string>

app/src/main/res/values-de/strings.xml

@@ -167,9 +167,6 @@
     <string name="settings_su_reauth_summary">Superuser-Berechtigungen nach App-Aktualisierung erneut authentifizieren</string>
     <string name="settings_su_tapjack_title">Tapjacking-Schutz aktivieren</string>
     <string name="settings_su_tapjack_summary">Das Dialogfeld der Superuser-Eingabeaufforderung reagiert nicht auf Eingaben, wenn es durch ein anderes Fenster oder Überlagerung verdeckt wird</string>
-    <string name="settings_su_biometric_title">Biometrische Authentifizierung aktivieren</string>
-    <string name="settings_su_biometric_summary">Biometrie verwenden, um Superuser-Anfragen zuzulassen</string>
-    <string name="no_biometric">Gerät unterstützt keine biometrischen Daten oder ist nicht mit diesen konfiguriert</string>
     <string name="settings_customization">Personalisierung</string>
     <string name="setting_add_shortcut_summary">Hinzufügen einer hübschen Startbildschirm-Verknüpfung, falls der Name und das Symbol nach dem Ausblenden der App schwer zu erkennen sind</string>
     <string name="settings_doh_title">DNS über HTTPS</string>

app/src/main/res/values-el/strings.xml

@@ -165,9 +165,6 @@
     <string name="settings_su_reauth_summary">Επαναπιστοποίηση αδειών υπερχρήστη μετά την αναβάθμιση μίας εφαρμογής</string>
     <string name="settings_su_tapjack_title">Ενεργοποίηση προστασίας Tapjacking</string>
     <string name="settings_su_tapjack_summary">Το παράθυρο διαλόγου προτροπής του υπερχρήστη δεν αποκρίνεται στην είσοδο ενώ κρύβεται από οποιοδήποτε άλλο παράθυρο</string>
-    <string name="settings_su_biometric_title">Ενεργοποίηση βιομετρικού ελέγχου ταυτότητας</string>
-    <string name="settings_su_biometric_summary">Χρησιμοποιήστε βιομετρικό έλεγχο ταυτότητας για να επιτρέψετε αιτήματα υπερχρηστών</string>
-    <string name="no_biometric">Δεν υποστηρίζεται η συσκευή ή δεν υπάρχει καμία βιομετρική ρύθμιση</string>
     <string name="settings_customization">Προσαρμογή</string>
     <string name="setting_add_shortcut_summary">Προσθέστε μια όμορφη συντόμευση στην αρχική οθόνη σε περίπτωση που το όνομα και το εικονίδιο είναι δύσκολο να αναγνωριστούν αφού κρύψετε την εφαρμογή</string>
     <string name="settings_doh_title">DNS μέσω HTTPS</string>

app/src/main/res/values-es/strings.xml

@@ -167,9 +167,6 @@
     <string name="settings_su_reauth_summary">Las apps volverán a solicitar privilegios de superusuario tras actualizarse</string>
     <string name="settings_su_tapjack_title">Protección contra tapjacking</string>
     <string name="settings_su_tapjack_summary">No podrás interactuar con las solicitudes de superusuario mientras estén tapadas por cualquier otra ventana o superposición</string>
-    <string name="settings_su_biometric_title">Autenticación biométrica</string>
-    <string name="settings_su_biometric_summary">Usa tu rostro, iris o huella digital para conceder privilegios de superusuario</string>
-    <string name="no_biometric">El dispositivo no está soportado o no has configurado ningún dato biométrico</string>
     <string name="settings_customization">Personalización</string>
     <string name="setting_add_shortcut_summary">Añade un atajo a la app con el ícono de Magisk a la pantalla de inicio en caso de que te resulte difícil reconocerla tras haberle cambiado el nombre y el ícono</string>
     <string name="settings_doh_title">DNS sobre HTTPS</string>

app/src/main/res/values-et/strings.xml

@@ -163,9 +163,6 @@
     <string name="settings_su_reauth_summary">Pärast rakenduste uuendamist küsi superkasutaja luba uuesti</string>
     <string name="settings_su_tapjack_title">Nupu varjamise kaitse</string>
     <string name="settings_su_tapjack_summary">Superkasutaja taotluse hüpik ei reageeri vajutusele, kui seda katab mõni teine aken või ülekate</string>
-    <string name="settings_su_biometric_title">Luba biomeetriaga autentimine</string>
-    <string name="settings_su_biometric_summary">Kasuta superkasutaja taotluste kinnitamiseks biomeetrilist autentimist</string>
-    <string name="no_biometric">Mittetoetatud seade või ükski biomeetriaseadistus pole lubatud</string>
     <string name="settings_customization">Kohandamine</string>
     <string name="setting_add_shortcut_summary">Lisa avakuvale ilus otsetee juhuks, kui nime ja ikooni on pärast rakenduse peitmist raske tuvastada</string>
     <string name="settings_doh_title">DNS üle HTTPSi</string>

app/src/main/res/values-fa/strings.xml

@@ -138,9 +138,6 @@
     <string name="superuser_notification">اعلان روت</string>
     <string name="settings_su_reauth_title">احراز هویت دوباره پس از بروز رسانی</string>
     <string name="settings_su_reauth_summary">تأیید کردندوباره مجوزهای روت پس از ارتقاء برنامه</string>
-    <string name="settings_su_biometric_title">فعال کردن احراز هویت بیومتریک</string>
-    <string name="settings_su_biometric_summary">استفاده کردن از احراز هویت بیومتریک برای تأیید درخواست های روت</string>
-    <string name="no_biometric">دستگاه پشتیبانی نمی شود یا تنظیمات بیومتریک فعال نیست</string>
     <string name="settings_customization">سفارشی سازی</string>
     <string name="setting_add_shortcut_summary">اضافه کردن یک میانبر زیبا را در صفحه اصلی در صورت شناسایی نام و نماد پس از پنهان کردن برنامه</string>
 

app/src/main/res/values-fr/strings.xml

@@ -88,6 +88,9 @@
     <string name="logs_cleared">Le journal a été effacé.</string>
     <string name="pid">PID : %1$d</string>
     <string name="target_uid">UID cible : %1$d</string>
+    <string name="target_pid">Montage ns PID cible: %s</string>
+    <string name="selinux_context">Contexte SELinux: %s</string>
+    <string name="supp_group">Groupe supplémentaire: %s</string>
 
     <!--SafetyNet-->
 
@@ -167,9 +170,9 @@
     <string name="settings_su_reauth_summary">Redemander une authentification pour autoriser l’accès en super‑utilisateur après une mise à jour de l’application</string>
     <string name="settings_su_tapjack_title">Activer la protection contre le détournement du tapotement</string>
     <string name="settings_su_tapjack_summary">Le dialogue d’invite du super‑utilisateur ne répondra pas à la saisie lorsqu’il est masqué par une autre fenêtre ou une surcouche</string>
-    <string name="settings_su_biometric_title">Activer l’authentification biométrique</string>
-    <string name="settings_su_biometric_summary">Utiliser l’authentification biométrique pour autoriser les accès en super‑utilisateur</string>
-    <string name="no_biometric">L’appareil n’est pas pris en charge ou alors aucun paramètre biométrique n’est activé</string>
+    <string name="settings_su_auth_title">Authentification utilisateur</string>
+    <string name="settings_su_auth_summary">Demander l’authentification utilisateur lors de la requête super-utilisateur</string>
+    <string name="settings_su_auth_insecure">Aucun méthode d’authentification utilisateur n’est configurée sur le périphérique</string>
     <string name="settings_customization">Personnalisation</string>
     <string name="setting_add_shortcut_summary">Ajouter un joli raccourci dans l’écran d’accueil au cas où le nom et l’icône seraient difficiles à reconnaître après avoir masqué l’application</string>
     <string name="settings_doh_title">DNS sur HTTPS</string>

app/src/main/res/values-hi/strings.xml

@@ -165,9 +165,6 @@
     <string name="settings_su_reauth_summary">एक ऐप अपडेट होने के बाद सुपरयूज़र अनुमति प्रमाणित करें</string>
     <string name="settings_su_tapjack_title">टैपजैकिंग सुरक्षा</string>
     <string name="settings_su_tapjack_summary">सुपरयुसर प्रॉम्प्ट डायलॉग किसी अन्य विंडो या ओवरले द्वारा अस्पष्ट होने पर इनपुट का जवाब नहीं देगा</string>
-    <string name="settings_su_biometric_title">बायोमेट्रिक प्रमाणीकरण सक्षम करें</string>
-    <string name="settings_su_biometric_summary">सुपरयूज़र अनुरोधों की अनुमति देने के लिए बायोमेट्रिक प्रमाणीकरण का उपयोग करें</string>
-    <string name="no_biometric">असमर्थित डिवाइस या कोई बायोमेट्रिक सेटिंग सक्षम नहीं हैं</string>
     <string name="settings_customization">कस्टमाईजेशन</string>
     <string name="setting_add_shortcut_summary">ऐप को छिपाने के बाद नाम और आइकन को पहचानना मुश्किल है, तो होम स्क्रीन में एक सुंदर शॉर्टकट जोड़ें</string>
     <string name="settings_doh_title">HTTPS पर DNS</string>

app/src/main/res/values-hr/strings.xml

@@ -142,9 +142,6 @@
     <string name="superuser_notification">Superuser obavijest</string>
     <string name="settings_su_reauth_title">Ponovno provjerite autentičnost nakon ažuriranja</string>
     <string name="settings_su_reauth_summary">Ponovno provjerite autentičnost Superuser-a dopuštenja nakon ažuriranja aplikacije</string>
-    <string name="settings_su_biometric_title">Omogući biometrijsku provjeru autentičnosti</string>
-    <string name="settings_su_biometric_summary">Koristi biometrijsku provjeru autentičnosti da biste omogućili zahtjeve Superuser-a</string>
-    <string name="no_biometric">Nepodržani uređaj ili nije omogućena biometrijska provjera autentičnosti</string>
     <string name="settings_customization">Prilagodba</string>
     <string name="setting_add_shortcut_summary">Dodajte lijepi prečac na početni zaslon u slučaju da je naziv i ikonu teško prepoznati nakon skrivanja aplikacije</string>
     <string name="settings_doh_title">DNS preko HTTPS-a</string>

app/src/main/res/values-hu/strings.xml

@@ -165,9 +165,6 @@
     <string name="settings_su_reauth_summary">Az appok frissítés után kérjenek ismét Superuser engedélyeket</string>
     <string name="settings_su_tapjack_title">Tapjacking védelem</string>
     <string name="settings_su_tapjack_summary">A Superuser kérés párbeszédpanel nem válaszol a bevitelre, ha más ablak vagy átfedés eltakarja</string>
-    <string name="settings_su_biometric_title">Biometrikus azonosítás</string>
-    <string name="settings_su_biometric_summary">Használjon biometrikus hitelesítést a Superuser kérések engedélyezéséhez</string>
-    <string name="no_biometric">Nem támogatott eszköz, vagy nincsenek engedélyezve a biometrikus beállítások</string>
     <string name="settings_customization">Testreszabás</string>
     <string name="setting_add_shortcut_summary">Adjon hozzá egy szép parancsikont a kezdőképernyőhöz arra az esetre, ha a nevet és az ikont nehéz felismerni az alkalmazás elrejtése után</string>
     <string name="settings_doh_title">DNS HTTPS-en keresztül</string>

app/src/main/res/values-in/strings.xml

@@ -167,9 +167,6 @@
     <string name="settings_su_reauth_summary">Autentikasi ulang izin akses superuser setelah aplikasi ditingkatkan</string>
     <string name="settings_su_tapjack_title">Aktifkan perlindungan tapjacking</string>
     <string name="settings_su_tapjack_summary">Dialog permintaan superuser tidak akan menanggapi masukan saat terhalangi oleh lapisan atau jendela lainnya</string>
-    <string name="settings_su_biometric_title">Aktifkan autentikasi biometrik</string>
-    <string name="settings_su_biometric_summary">Gunakan autentikasi biometrik untuk mengizinkan permintaan superuser</string>
-    <string name="no_biometric">Perangkat tidak mendukung atau setelan biometrik tidak diaktifkan</string>
     <string name="settings_customization">Personalisasi</string>
     <string name="setting_add_shortcut_summary">Tambahkan pintasan yang menarik pada layar utama seandainya nama dan ikon sulit untuk dikenali setelah menyembunyikan aplikasi</string>
     <string name="settings_doh_title">DNS melalui HTTPS</string>

app/src/main/res/values-it/strings.xml

@@ -165,9 +165,9 @@
     <string name="settings_su_reauth_summary">Richiedi nuovamente i permessi di root dopo l\'aggiornamento di un\'app</string>
     <string name="settings_su_tapjack_title">Protezione anti-tapjacking</string>
     <string name="settings_su_tapjack_summary">La schermata di richiesta dei permessi di root non risponderà al tocco mentre è oscurata da altre finestre o elementi in sovraimpressione</string>
-    <string name="settings_su_biometric_title">Autenticazione biometrica</string>
-    <string name="settings_su_biometric_summary">Utilizza l\'autenticazione biometrica per accettare le richieste di accesso root</string>
-    <string name="no_biometric">Il dispositivo non è supportato o le impostazioni biometriche sono disattivate</string>
+    <string name="settings_su_auth_title">Autenticazione utente</string>
+    <string name="settings_su_auth_summary">Richiedi l\'autenticazione dell\'utente per le richieste di accesso root</string>
+    <string name="settings_su_auth_insecure">Sul dispositivo non è configurato alcun metodo di autenticazione</string>
     <string name="settings_customization">Personalizzazione</string>
     <string name="setting_add_shortcut_summary">Aggiungi un collegamento alla schermata iniziale se il nome e l\'icona sono difficili da riconoscere dopo aver nascosto l\'app</string>
     <string name="settings_doh_title">DNS over HTTPS</string>

app/src/main/res/values-iw/strings.xml

@@ -8,6 +8,8 @@
     <string name="install">התקנה</string>
     <string name="section_home">בית</string>
     <string name="section_theme">עיצוב</string>
+    <string name="denylist">רשימת דחייה</string>
+
 
     <!--Home-->
     <string name="no_connection">אין חיבור זמין</string>
@@ -18,10 +20,11 @@
     <string name="hide">הסתרה</string>
     <string name="home_package">חבילה</string>
     <string name="home_app_title">יישום</string>
-	<string name="home_notice_content">הורד את Magisk רק מהדף הרשמי של GitHub. קבצים ממקורות לא ידועים יכולים להיות זדוניים!</string>
-	<string name="home_support_title">תמיכה בנו</string>
+    <string name="home_notice_content">יש להוריד את Magisk רק מהדף הרשמי של GitHub. קבצים ממקורות לא ידועים יכולים להיות זדוניים!</string>
+    <string name="home_support_title">תמיכה בנו</string>
+    <string name="home_follow_title">עקבו אחרינו</string>
     <string name="home_item_source">מקור</string>
-    <string name="home_support_content">Magisk היה ותמיד יהיה בעל קוד מקור פתוח. עם זאת אתה יכול להראות לנו שאכפת לך על ידי שליחת תרומה קטנה.</string>
+    <string name="home_support_content">Magisk היה ותמיד יהיה בעל קוד מקור פתוח. עם זאת באפשרותך להראות לנו שאכפת לך על ידי שליחת תרומה קטנה.</string>
     <string name="home_installed_version">מותקנת</string>
     <string name="home_latest_version">אחרונה</string>
     <string name="invalid_update_channel">ערוץ עדכון לא חוקי</string>
@@ -31,18 +34,19 @@
     <!--Install-->
     <string name="keep_force_encryption">שמירה על הצפנה בכח</string>
     <string name="keep_dm_verity">שמירה על AVB 2.0/dm-verity</string>
+    <string name="patch_vbmeta">תיקון vbmeta בתמונת האתחול</string>
     <string name="recovery_mode">מצב שחזור</string>
     <string name="install_options_title">אפשרויות</string>
     <string name="install_method_title">שיטה</string>
     <string name="install_next">הבא</string>
     <string name="install_start">צא לדרך</string>
-    <string name="manager_download_install">לחץ להורדה והתקנה</string>
+    <string name="manager_download_install">לחיצה להורדה והתקנה</string>
     <string name="direct_install">התקנה ישירה (מומלץ)</string>
-    <string name="install_inactive_slot">התקן לחריץ לא פעיל (לאחר OTA)</string>
+    <string name="install_inactive_slot">התקנה לחריץ לא פעיל (לאחר OTA)</string>
     <string name="install_inactive_slot_msg">ההתקן שלך ייאלץ אתחול לחריץ הלא פעיל הנוכחי שלך לאחר הפעלה מחדש!\nיש להשתמש באפשרות זו רק לאחר ביצוע OTA בלבד.\nלהמשיך?</string>
     <string name="setup_title">התקנה נוספת</string>
-    <string name="select_patch_file">בחר והתקן קובץ</string>
-    <string name="patch_file_msg">בחר תמונה גולמית (*.img) או ODIN קובץ tar (*.tar)</string>
+    <string name="select_patch_file">בחירה והתקנת קובץ</string>
+    <string name="patch_file_msg">בחירת תמונה גולמית (*.img) או ODIN קובץ tar (*.tar)</string>
     <string name="reboot_delay_toast">מאתחל בעוד 5 שניות…</string>
     <string name="flash_screen_title">התקנה</string>
 
@@ -52,7 +56,7 @@
     <string name="deny">דחה</string>
     <string name="prompt">מיידי</string>
     <string name="grant">הענק</string>
-    <string name="su_warning">מעניק גישה מלאה להתקן שלך.\nדחה באם אינך בטוח!</string>
+    <string name="su_warning">מעניק גישה מלאה להתקן שלך.\nיש לדחות באי וודאות!</string>
     <string name="forever">לצמיתות</string>
     <string name="once">פעם אחת</string>
     <string name="tenmin">10 דקות</string>
@@ -76,13 +80,16 @@
     <string name="superuser_policy_none">לא נתבקשו הרשאות משתמש על על ידי שום יישום</string>
 
     <!--Logs-->
-    <string name="log_data_none">הינך ללא יומן רישום, נסה להשתמש ביישומים מותאמים יותר למשתמש העל שלך</string>
+    <string name="log_data_none">הינך ללא יומן רישום, יש לנסות להשתמש ביישומים מותאמים יותר למשתמש העל שלך</string>
     <string name="log_data_magisk_none">יומני רישום Magisk ריקים, זה מוזר</string>
-    <string name="menuSaveLog">שמור יומן רישום</string>
-    <string name="menuClearLog">נקה יומן רישום כעת</string>
+    <string name="menuSaveLog">שמירת יומן רישום</string>
+    <string name="menuClearLog">ניקוי יומן רישום כעת</string>
     <string name="logs_cleared">יומני רישום נוקו בהצלחה</string>
     <string name="pid">PID: %1$d</string>
     <string name="target_uid">יעד UID: %1$d</string>
+    <string name="target_pid">מציב ns יעד PID: %s</string>
+    <string name="selinux_context">הקשר SELinux: %s</string>
+    <string name="supp_group">קבוצה משלימה: %s</string>
 
     <!--SafetyNet-->
 
@@ -100,35 +107,47 @@
     <string name="reboot_download">אתחול מצב הורדה</string>
     <string name="reboot_edl">אתחול למצב EDL</string>
     <string name="module_version_author">%1$s מאת %2$s</string>
-    <string name="module_state_remove">הסר</string>
-    <string name="module_state_restore">שחזר</string>
-    <string name="module_action_install_external">התקן מהאחסון</string>
+    <string name="module_state_remove">הסרה</string>
+    <string name="module_state_restore">שיחזור</string>
+    <string name="module_action_install_external">התקנה מהאחסון</string>
     <string name="update_available">עדכונים זמינים</string>
+    <string name="suspend_text_riru">מודול מושעה כי %1$s מופעל</string>
+    <string name="suspend_text_zygisk">המודול הושעה כי %1$s אינו מופעל</string>
+    <string name="zygisk_module_unloaded">מודול Zygisk לא נטען עקב חוסר תאימות</string>
+    <string name="module_empty">לא מותקן מודול</string>
+    <string name="confirm_install">להתקין מודול %1$s?</string>
+    <string name="confirm_install_title">אישור התקנה</string>
 
     <!--Settings -->
     <string name="settings_dark_mode_title">מצב עיצוב</string>
-    <string name="settings_dark_mode_message">בחר מצב המתאים ביותר לסגנון שלך!</string>
+    <string name="settings_dark_mode_message">נא לבחור מצב המתאים ביותר לסגנון שלך!</string>
     <string name="settings_dark_mode_light">תמיד בהיר</string>
     <string name="settings_dark_mode_system">בהתאם למערכת</string>
     <string name="settings_dark_mode_dark">תמיד כהה</string>
     <string name="settings_download_path_title">נתיב הורדה</string>
     <string name="settings_download_path_message">הקבצים ישמרו אל %1$s</string>
-    <string name="settings_hide_app_title">הסתר את היישום Magisk</string>
-    <string name="settings_hide_app_summary">התקן יישום מתווך עם מזהה חבילה אקראי ותווית שם מותאמת אישית</string>
-    <string name="settings_restore_app_title">שחזר את יישום Magisk</string>
-    <string name="settings_restore_app_summary">בטל את הסתרת היישום ושחזר אותה ל-APK המקורי</string>
-	<string name="language">שפה</string>
+    <string name="settings_hide_app_title">הסתרת היישום Magisk</string>
+    <string name="settings_hide_app_summary">התקנת יישום מתווך עם מזהה חבילה אקראי ותווית שם מותאמת אישית</string>
+    <string name="settings_restore_app_title">שיחזור היישום Magisk</string>
+    <string name="settings_restore_app_summary">יש לבטל את הסתרת היישום ולשחזור אותו ל-APK המקורי</string>
+    <string name="language">שפה</string>
     <string name="system_default">(ברירת מחדל מערכת)</string>
-    <string name="settings_check_update_title">בדוק עדכונים</string>
+    <string name="settings_check_update_title">בדיקת עדכונים</string>
     <string name="settings_check_update_summary">בדוק מעת לעת ברקע אם יש עדכונים</string>
     <string name="settings_update_channel_title">ערוץ עדכון</string>
     <string name="settings_update_stable">יציב</string>
     <string name="settings_update_beta">בטא</string>
-    <string name="settings_update_custom">ערוץ מותאם אישית</string>
-    <string name="settings_update_custom_msg">הזן כתובת מותאמת אישית</string>
+    <string name="settings_update_custom">מותאם אישית</string>
+    <string name="settings_update_custom_msg">הזנת כתובת מותאמת אישית</string>
+    <string name="settings_zygisk_summary">הפעל חלקים של Magisk בדמון zygote</string>
+    <string name="settings_denylist_title">אכיפת רשימת דחייה</string>
+    <string name="settings_denylist_summary">כל השינויים של Magisk יוחזרו לתהליכים ברשימת הדחייה</string>
+    <string name="settings_denylist_error">תכונה זו דורשת הפעלה של %1$s</string>
+    <string name="settings_denylist_config_title">הגדרת רשימת הדחייה</string>
+    <string name="settings_denylist_config_summary">בחירת התהליכים שייכללו ברשימת הדחייה</string>
     <string name="settings_hosts_title">מארחים חסרי מערכת</string>
     <string name="settings_hosts_summary">מארחים חסרי מערכת תומכים ביישומים חוסמי פרסומות</string>
-    <string name="settings_hosts_toast">הוסף מודול מארחים חסרי מערכת</string>
+    <string name="settings_hosts_toast">הוספת מודול מארחים חסרי מערכת</string>
     <string name="settings_app_name_hint">שם חדש</string>
     <string name="settings_app_name_helper">היישום יארז מחדש בשם זה</string>
     <string name="settings_app_name_error">פורמט לא חוקי</string>
@@ -146,15 +165,15 @@
     <string name="auto_response">תגובה אוטומטית</string>
     <string name="request_timeout">בקש פסק זמן</string>
     <string name="superuser_notification">התראות משתמש על</string>
-    <string name="settings_su_reauth_title">אמת מחדש לאחר שדרוג</string>
+    <string name="settings_su_reauth_title">אימות מחדש לאחר שדרוג</string>
     <string name="settings_su_reauth_summary">אימות מחדש הרשאות של משתמש על לאחר שדרוג יישום</string>
     <string name="settings_su_tapjack_title">הפעלת הגנת Tapjacking</string>
     <string name="settings_su_tapjack_summary">תיבת הדו שיח של משתמש העל לא תגיב לקלט כשהיא מוסתרת על ידי חלון או כיסוי אחר</string>
-	<string name="settings_su_biometric_title">אפשר אימות ביומטרי</string>
-	<string name="settings_su_biometric_summary">השתמש באימות ביומטרי כדי לאפשר בקשות לשימוש במשתמש על</string>
-    <string name="no_biometric">התקן לא נתמך או הגדרות ביומטריות אינן מאופשרות</string>
+    <string name="settings_su_auth_title">אימות משתמש</string>
+    <string name="settings_su_auth_summary">בקשת אימות משתמש במהלך בקשות משתמש על</string>
+    <string name="settings_su_auth_insecure">לא מוגדרת שיטת אימות בהתקן</string>
     <string name="settings_customization">התאמה אישית</string>
-    <string name="setting_add_shortcut_summary">הוסף קיצור דרך יפה במסך הבית למקרה שקשה לזהות את השם ואת הסמל לאחר הסתרת היישום</string>
+    <string name="setting_add_shortcut_summary">הוספת קיצור דרך יפה במסך הבית למקרה שקשה לזהות את השם ואת הסמל לאחר הסתרת היישום</string>
     <string name="settings_doh_title">DNS על HTTPS</string>
     <string name="settings_doh_description">עקיפת DNS מורעל במדינות מסוימות</string>
     <string name="multiuser_mode">מצב מרובה משתמשים</string>
@@ -175,13 +194,17 @@
     <!--Notifications-->
     <string name="update_channel">עדכוני Magisk</string>
     <string name="progress_channel">התראות התקדמות</string>
+    <string name="updated_channel">העדכון הושלם</string>
     <string name="download_complete">ההורדה הושלמה</string>
     <string name="download_file_error">שגיאה בהורדת קובץ</string>
     <string name="magisk_update_title">עדכון Magisk זמין!</string>
+    <string name="updated_title">עדכון Magisk</string>
+    <string name="updated_text">הקשה כדי לפתוח יישום</string>
 
     <!--Toasts, Dialogs-->
     <string name="yes">כן</string>
     <string name="no">לא</string>
+    <string name="repo_install_title">מתקין %1$s %2$s(%3$d)</string>
     <string name="download">הורדה</string>
     <string name="reboot">הפעלה מחדש</string>
     <string name="release_notes">הערות שחרור</string>
@@ -189,7 +212,7 @@
     <string name="done">בוצע!</string>
     <string name="failure">נכשל</string>
     <string name="hide_app_title">מסתיר את יישום Magisk…</string>
-	<string name="open_link_failed_toast">לא נמצאו יישומים לפתיחת קישור זה</string>
+    <string name="open_link_failed_toast">לא נמצאו יישומים לפתיחת קישור זה</string>
     <string name="complete_uninstall">הסרה מלאה</string>
     <string name="restore_img">שיחזור תמונות</string>
     <string name="restore_img_msg">משחזר…</string>
@@ -197,8 +220,9 @@
     <string name="restore_fail">גיבוי מקורי אינו קיים!</string>
     <string name="setup_fail">ההתקנה כשלה</string>
     <string name="env_fix_title">דורש התקנה נוספת</string>
-    <string name="env_fix_msg">המכשיר שלך זקוק להתקנה נוספת כדי ש-Magisk יפעל כראוי. האם ברצונך להמשיך ולהפעיל מחדש?</string>
-	<string name="setup_msg">הגדרת סביבת ריצה…</string>
+    <string name="env_fix_msg">ההתקן שלך זקוק להתקנה נוספת כדי ש-Magisk יפעל כראוי. האם ברצונך להמשיך ולהפעיל מחדש?</string>
+    <string name="env_full_fix_msg">ההתקן שלך זקוק לצריבה מחדש של Magisk כדי לעבוד כראוי. נא להתקין מחדש את Magisk בתוך היישום, מצב השחזור אינו יכול לקבל מידע נכון על ההתקן.</string>
+    <string name="setup_msg">הגדרת סביבת ריצה…</string>
     <string name="authenticate">אימות</string>
     <string name="unsupport_magisk_title">גרסת Magisk אינה נתמכת</string>
     <string name="unsupport_magisk_msg">גרסה זו של היישום אינה תומכת ביישום  Magisk הנמוך מ- %1$s.\n\nהיישום יתנהג כאילו Magisk אינו מותקן,יש לשדרג את Magisk במהירות האפשריות.</string>
@@ -208,8 +232,12 @@
     <string name="unsupport_external_storage_msg">Magisk מותקן באחסון החיצוני. נא להעביר את היישום לאחסון הפנימי.</string>
     <string name="unsupport_nonroot_stub_msg">היישום אינו יכול להמשיך לעבוד במצב הנסתר מכיוון שגישת השורש אבדה. נא לשחזר אותו חזרה ל-APK המקורי.</string>
     <string name="unsupport_nonroot_stub_title">@string/settings_restore_app_title</string>
-	<string name="external_rw_permission_denied">הענק הרשאת אחסון להפעלת פונקציונליות זו</string>
-    <string name="add_shortcut_title">הוסף קיצור דרך למסך הבית</string>
+    <string name="external_rw_permission_denied">הענת הרשאת אחסון להפעלת פונקציה זו</string>
+    <string name="post_notifications_denied">הענקת הרשאה להתראות כדי להפעיל פונקציה זו</string>
+    <string name="install_unknown_denied">יש לאפשר "התקנה ממקורות לא ידועים" בכדי להפעיל פונקציה זו</string>
+    <string name="add_shortcut_title">הוספת קיצור דרך למסך הבית</string>
     <string name="add_shortcut_msg">לאחר הסתרת היישום הזה, השם והסמליל שלה עשויים להיות קשים לזיהוי. האם ברצונך להוסיף קיצור דרך יפה למסך הבית?</string>
-	<string name="app_not_found">לא נמצא יישום לטיפול בפעולה זו</string>
+    <string name="app_not_found">לא נמצא יישום לטיפול בפעולה זו</string>
+    <string name="reboot_apply_change">ייש להפעיל מחדש כדי להחיל שינויים</string>
+    <string name="restore_app_confirmation">פעולה זו תשחזר את היישום המוסתר חזרה ליישום המקורי. האם בוודאות ברצונך לעשות את זה?</string>
 </resources>

app/src/main/res/values-ja/strings.xml

@@ -165,9 +165,9 @@
     <string name="settings_su_reauth_summary">アプリのアップグレード後にスーパーユーザー権限を再認証します</string>
     <string name="settings_su_tapjack_title">タップジャッキング保護を有効にする</string>
     <string name="settings_su_tapjack_summary">他のウィンドウやオーバーレイで表示されている間は、スーパーユーザー権限の要求ダイアログが入力に応答しないようにします</string>
-    <string name="settings_su_biometric_title">生体認証の有効化</string>
-    <string name="settings_su_biometric_summary">スーパーユーザー権限の要求時に生体認証を使用します</string>
-    <string name="no_biometric">生体認証に対応していないか、有効化されていません</string>
+    <string name="settings_su_auth_title">ユーザー認証</string>
+    <string name="settings_su_auth_summary">スーパーユーザー権限の要求でユーザー認証を行ないます</string>
+    <string name="settings_su_auth_insecure">端末の認証方法が設定されていません</string>
     <string name="settings_customization">カスタマイズ</string>
     <string name="setting_add_shortcut_summary">アプリを隠した後に見つけられなくなったときは、ここでホーム画面にショートカットを追加できます</string>
     <string name="settings_doh_title">DNS over HTTPS</string>

app/src/main/res/values-ka/strings.xml

@@ -152,9 +152,6 @@
     <string name="settings_su_reauth_summary">სუპერმომხმარებლის ნებართვის რეაუტენთიფიკაცია აპის განახლების შემდეგ</string>
     <string name="settings_su_tapjack_title">Tapjacking-სგან თავის დაცვა</string> <!-- TODO: tapjacking has no direct translation; must make something up later -->
     <string name="settings_su_tapjack_summary">superuser-ის დიალოგის ღილაკებზე დაჭერა არ იქნება შესაძლებელი თუ სხვა აპი არის მასზე გადახურული</string>
-    <string name="settings_su_biometric_title">ბიომეტრიკული აუტენთიფიკაციის ჩართვა</string>
-    <string name="settings_su_biometric_summary">ბიომეტრიკული აუტენთიფიკაციის გამოყენება სუპერმომხმარებლის ნებართვის გასაცემად</string>
-    <string name="no_biometric">შეუთავსებელი მოწყობილობა ან არასწორად დაყენებული ბიომეტრიკული პარამეტრები</string>
     <string name="settings_customization">პერსონალიზაცია</string>
     <string name="setting_add_shortcut_summary">ლამაზი ხატულის დამატება საწყისს ეკრანზე, იმ შემთხვევაში თუ აპის ამოცნობა არის რთული დამალვის შემდეგ</string>
     <string name="settings_doh_title">DNS HTTPS-ზე</string>

app/src/main/res/values-ko/strings.xml

@@ -163,9 +163,6 @@
     <string name="settings_su_reauth_summary">앱이 업데이트되면 권한 승인 요청을 다시 합니다.</string>
     <string name="settings_su_tapjack_title">탭재킹 보호 활성화</string>
     <string name="settings_su_tapjack_summary">슈퍼유저 프롬프트가 다른 창이나 오버레이로 가려지는 동안의 입력을 무시합니다.</string>
-    <string name="settings_su_biometric_title">생체 인증 활성화</string>
-    <string name="settings_su_biometric_summary">슈퍼유저 요청 허용에 생체 인증을 사용합니다.</string>
-    <string name="no_biometric">지원되지 않는 기기이거나 등록된 생체 정보가 없습니다.</string>
     <string name="settings_customization">커스터마이즈</string>
     <string name="setting_add_shortcut_summary">앱을 숨긴 후 아이콘과 이름을 알아보기 힘들 경우를 위해 알아보기 쉬운 바로가기를 홈 화면에 추가합니다.</string>
     <string name="settings_doh_title">DNS over HTTPS</string>

app/src/main/res/values-lt/strings.xml

@@ -167,9 +167,6 @@
     <string name="settings_su_reauth_summary">Iš naujo prašyti supernaudotojo teisių po programėlių naujinimo</string>
     <string name="settings_su_tapjack_title">Bakstelėjimų perėmimo apsauga</string>
     <string name="settings_su_tapjack_summary">Supernaudotojo užklausos langas bus neaktyvus, kol jis yra užstotas kito lango</string>
-    <string name="settings_su_biometric_title">Biometrinis autentifikavimas</string>
-    <string name="settings_su_biometric_summary">Naudoti biometrinį autentifikavimą supernaudotojo užklausų patvirtinimui</string>
-    <string name="no_biometric">Nepalaikomas įrenginys arba biometriniai nustatymai neįjungti</string>
     <string name="settings_customization">Tinkinimas</string>
     <string name="setting_add_shortcut_summary">Pridėti nuorodą į pagrindinį ekraną, jei po programėlės paslėpimo yra sunku atpažinti jos pavadinimą ir piktogramą</string>
     <string name="settings_doh_title">DNS virš HTTPS</string>

app/src/main/res/values-ml/strings.xml

@@ -22,7 +22,7 @@
 
     <string name="home_notice_content">ഔദ്യോഗിക ഗിറ്റ്ഹബ് പേജിൽ നിന്ന് മാത്രം മജിസ്‌ക് ഡൗൺലോഡ് ചെയ്യുക. അജ്ഞാത ഉറവിടങ്ങളിൽ നിന്നുള്ള ഫയലുകൾ ക്ഷുദ്രകരമാകാം!</string>
     <string name="home_support_title">ഞങ്ങളെ തുണയ്‌ക്കുക</string>
-    <string name="home_follow_title">ഞങ്ങളെ പിന്തുടരുക</string>
+    <string name="home_follow_title">ഞങ്ങളെ ഫോളോ ചെയ്യുക</string>
     <string name="home_item_source">സോഴ്സ്</string>
     <string name="home_support_content">മജിസ്‌ക് എല്ലായ്പ്പോഴും സ്വതന്ത്രവും ഓപ്പൺ സോഴ്‌സും ആയിരിക്കും. എന്നിരുന്നാലും, ഒരു സംഭാവന നൽകിക്കൊണ്ട് നിങ്ങൾ പിന്തുണയ്ക്കുന്നുവെന്ന് ഞങ്ങളെ കാണിക്കാനാകും.</string>
     <string name="home_installed_version">ഇൻസ്റ്റാൾ ചെയ്ത പതിപ്പ്</string>
@@ -58,7 +58,7 @@
     <string name="grant">അനുവദിക്കുക</string>
     <string name="su_warning">നിങ്ങളുടെ ഉപകരണത്തിലേക്ക് പൂർണ്ണ ആക്‌സസ് നൽകും.\nനിങ്ങൾക്ക് ഉറപ്പില്ലെങ്കിൽ നിരസിക്കുക!</string>
     <string name="forever">എന്നേക്കും</string>
-    <string name="once">ഒരിക്കല്</string>
+    <string name="once">ഒരിക്കൽ</string>
     <string name="tenmin">10 മിനിറ്റ്</string>
     <string name="twentymin">20 മിനിറ്റ്</string>
     <string name="thirtymin">30 മിനിറ്റ്</string>
@@ -133,8 +133,8 @@
     <string name="settings_update_channel_title">അപ്ഡേറ്റിനുള്ള ചാനൽ</string>
     <string name="settings_update_stable">സ്റ്റേബിൾ</string>
     <string name="settings_update_beta">ബീറ്റ</string>
-    <string name="settings_update_custom">കസ്റ്റമ്</string>
-    <string name="settings_update_custom_msg">കസ്റ്റമ് ചാനലിന്റെ URL ചേർക്കുക</string>
+    <string name="settings_update_custom">കസ്റ്റം</string>
+    <string name="settings_update_custom_msg">കസ്റ്റം ചാനലിന്റെ URL ചേർക്കുക</string>
     <string name="settings_zygisk_summary">സൈഗോട്ട് ഡെമണിൽ മജിസ്കിന്റെ ഭാഗങ്ങൾ പ്രവർത്തിപ്പിക്കുക</string>
     <string name="settings_denylist_title">നിഷിദ്ധ പട്ടിക പ്രാബല്യത്തിലാകുക</string>
     <string name="settings_denylist_summary">നിഷിദ്ധ പട്ടികയിലെ പ്രോസസ്സുകൾക്കായി എല്ലാ മജിസ്‌ക് പരിഷ്‌ക്കരണങ്ങളും പഴയപടിയാക്കും</string>
@@ -165,13 +165,10 @@
     <string name="settings_su_reauth_summary">ആപ്പുകൾ അപ്‌ഗ്രേഡ് ചെയ്‌തതിന് ശേഷം സൂപ്പർയൂസർ അനുമതികൾക്കായി വീണ്ടും ആവശ്യപ്പെടുക</string>
     <string name="settings_su_tapjack_title">ടാപ്പ്ജാക്കിംഗ് സംരക്ഷണം</string>
     <string name="settings_su_tapjack_summary">സൂപ്പർയൂസർ പ്രോംപ്റ്റ് ഡയലോഗ് മറ്റേതെങ്കിലും വിൻഡോയോ ഓവർലേയോ മറയ്ക്കുമ്പോൾ ഇൻപുട്ടിനോട് പ്രതികരിക്കില്</string>
-    <string name="settings_su_biometric_title">ബയോമെട്രിക് പ്രാമാണീകരണം</string>
-    <string name="settings_su_biometric_summary">സൂപ്പർയൂസർ അഭ്യർത്ഥനകൾ അനുവദിക്കുന്നതിന് ബയോമെട്രിക് പ്രാമാണീകരണം ഉപയോഗിക്കുക</string>
-    <string name="settings_customization">Customization</string>
-    <string name="no_biometric">പിന്തുണയ്‌ക്കാത്ത ഉപകരണം അല്ലെങ്കിൽ ബയോമെട്രിക് ഒന്നും പ്രവർത്തനക്ഷമമാക്കിയിട്ടില്ല</string>
+    <string name="settings_customization">കസ്റ്റമയിസേഷൻ</string>
     <string name="setting_add_shortcut_summary">ആപ്പ് മറച്ചതിന് ശേഷം പേരും ഐക്കണും തിരിച്ചറിയാൻ പ്രയാസമാണെങ്കിൽ ഹോം സ്‌ക്രീനിലേക്ക് മനോഹരമായ ഒരു ഷോർട്ട്ക്കട് ചേർക്കുക</string>
     <string name="settings_doh_title">DNS ഓവർ HTTPS</string>
-    <string name="settings_doh_description">ചില രാജ്യങ്ങളിൽ DNS പോയ്സണിങിന് പരിഹാരം</string>
+    <string name="settings_doh_description">ചില രാജ്യങ്ങളിലെ DNS പോയ്സണിങിന് പരിഹാരം</string>
 
     <string name="multiuser_mode">മൾട്ടിയൂസർ മോഡ്</string>
     <string name="settings_owner_only">ഉപകരണ ഉടമ മാത്രം</string>
@@ -232,7 +229,7 @@
     <string name="external_rw_permission_denied">ഈ പ്രവർത്തനം പ്രവർത്തനക്ഷമമാക്കാൻ സ്റ്റോറജ് ​​അനുമതി നൽകുക</string>
     <string name="post_notifications_denied">ഈ പ്രവർത്തനം പ്രവർത്തനക്ഷമമാക്കാൻ അറിയിപ്പ്‌ അനുമതി നൽകുക</string>
     <string name="install_unknown_denied">ഈ പ്രവർത്തനം പ്രവർത്തനക്ഷമമാക്കാൻ "install unknown apps" അനുവദിക്കുക</string>
-    <string name="add_shortcut_title">ഹോം സ്ക്രീനിലേക്ക് ഷോർറ്റ്കറ്റ് ചേർക്കുക</string>
+    <string name="add_shortcut_title">ഹോം സ്ക്രീനിലേക്ക് ഷോർട്ട്കട്ട് ചേർക്കുക</string>
     <string name="add_shortcut_msg">ഈ ആപ്പ് മറച്ചതിന് ശേഷം, അതിന്റെ പേരും ഐക്കണും തിരിച്ചറിയാൻ ബുദ്ധിമുട്ടായേക്കാം. ഹോം സ്‌ക്രീനിലേക്ക് മനോഹരമായ ഒരു ഷോർറ്റ്കറ്റ ചേർക്കാൻ നിങ്ങൾ ആഗ്രഹിക്കുന്നുണ്ടോ?</string>
     <string name="app_not_found">ഈ പ്രവർത്തനം കൈകാര്യം ചെയ്യാൻ ഒരു ആപ്പും കണ്ടെത്തിയില്ല</string>
     <string name="reboot_apply_change">മാറ്റങ്ങൾ പ്രയോഗിക്കാൻ റീബൂട്ട് ചെയ്യുക</string>

app/src/main/res/values-nb/strings.xml

@@ -152,9 +152,6 @@
     <string name="settings_su_reauth_summary">Identitetsbekreft superbrukertilganger etter programoppgraderinger</string>
     <string name="settings_su_tapjack_title">Trykkstjelingsbeskyttelse</string>
     <string name="settings_su_tapjack_summary">Superbrukings-forespørselsdialogen vil ikke svare på inndata mens den dekkes av et annet vindu eller lag</string>
-    <string name="settings_su_biometric_title">Biometrisk identitetsbekreftelse</string>
-    <string name="settings_su_biometric_summary">Bruk biometrisk identitetsbekreftelse for å tillate superbruker-forespørsler</string>
-    <string name="no_biometric">Ustøttet enhet, eller mangel på biometrisk oppsett</string>
     <string name="settings_customization">Tilpasning</string>
     <string name="setting_add_shortcut_summary">Legg til fin snarvei på hjemmeskjermen i fall navnet og ikonet er vanskelig å gjenkjenne etter skjuling av programmet</string>
     <string name="settings_doh_title">DNS over HTTPS</string>

app/src/main/res/values-nl/strings.xml

@@ -141,9 +141,6 @@
     <string name="superuser_notification">Superusermelding</string>
     <string name="settings_su_reauth_title">Opnieuw goedkeuren na update</string>
     <string name="settings_su_reauth_summary">Superuserrechten opnieuw goedkeuren na app-updates.</string>
-    <string name="settings_su_biometric_title">Biometrische authenticatie gebruiken</string>
-    <string name="settings_su_biometric_summary">Gebruik biometrische authenticatie om superuserverzoeken goed te keuren.</string>
-    <string name="no_biometric">Niet-ondersteund apparaat of geen biometrische authenticatie ingesteld</string>
     <string name="settings_customization">Aanpassingen</string>
 
     <string name="multiuser_mode">Meerdere gebruikers</string>

app/src/main/res/values-pa/strings.xml

@@ -143,9 +143,6 @@
     <string name="superuser_notification">ਸੁਪਰਯੂਜ਼ਰ ਸੂਚਨਾ</string>
     <string name="settings_su_reauth_title">ਅਪਗ੍ਰੇਡ ਹੋਣ ਤੋਂ ਬਾਅਦ ਪ੍ਰਮਾਣਿਕਤਾ</string>
     <string name="settings_su_reauth_summary">ਇੱਕ ਐਪ ਦੇ ਅਪਡੇਟ ਹੋਣ ਤੋਂ ਬਾਅਦ ਸੁਪਰਯੂਜ਼ਰ ਆਗਿਆ ਪ੍ਰਮਾਣਿਤ ਕਰੋ</string>
-    <string name="settings_su_biometric_title">ਬਾਇਓਮੈਟ੍ਰਿਕ ਪ੍ਰਮਾਣਿਕਤਾ ਦਾ ਯੋਗ ਕਰੋ</string>
-    <string name="settings_su_biometric_summary">ਸੁਪਰਯੂਜ਼ਰ ਦੀ ਆਗਿਆ ਦੇਣ ਲਈ ਬਾਇਓਮੈਟ੍ਰਿਕ ਪ੍ਰਮਾਣੀਕਰਣ ਦੀ ਵਰਤੋਂ ਕਰੋ</string>
-    <string name="no_biometric">ਅਸਮਰਥਿਤ ਡਿਵਾਈਸ ਜਾਂ ਕੋਈ ਬਾਇਓਮੈਟ੍ਰਿਕ ਸੈਟਿੰਗ ਸਮਰਥਿਤ ਨਹੀਂ ਹੈ</string>
     <string name="settings_customization">ਕਸਟਮਾਈਜੇਸ਼ਨ</string>
     <string name="setting_add_shortcut_summary">ਐਪ ਨੂੰ ਲੁਕਾਉਣ ਤੋਂ ਬਾਅਦ ਨਾਮ ਅਤੇ ਆਈਕਾਨ ਨੂੰ ਪਛਾਣਨਾ ਮੁਸ਼ਕਲ ਹੈ, ਤਾਂ ਹੋਮ ਸਕ੍ਰੀਨ ਵਿਚ ਇਕ ਸੁੰਦਰ ਸ਼ਾਰਟਕੱਟ ਸ਼ਾਮਲ ਕਰੋ</string>
     <string name="settings_doh_title">DNS ਉੱਤੇ HTTPS</string>

app/src/main/res/values-pl/strings.xml

@@ -8,7 +8,7 @@
     <string name="install">Instaluj</string>
     <string name="section_home">Strona główna</string>
     <string name="section_theme">Motywy</string>
-    <string name="denylist">Lista odmów</string>
+    <string name="denylist">Lista odmów (DenyList)</string>
 
     <!--Home-->
     <string name="no_connection">Połączenie niedostępne</string>
@@ -28,8 +28,8 @@
     <string name="home_installed_version">Zainstalowany</string>
     <string name="home_latest_version">Ostatni</string>
     <string name="invalid_update_channel">Nieprawidłowy kanał aktualizacji</string>
-    <string name="uninstall_magisk_title">Odinstaluj Magisk</string>
-    <string name="uninstall_magisk_msg">Wszystkie moduły zostaną wyłączone/usunięte!\nRoot zostanie usunięty!\nTwoje dane mogą zostać potencjalnie zaszyfrowane, jeśli jeszcze nie są!</string>
+    <string name="uninstall_magisk_title">Odinstalowywanie Magisk</string>
+    <string name="uninstall_magisk_msg">Wszystkie moduły zostaną wyłączone/usunięte!\nRoot zostanie usunięty!\nWszelka wewnętrzna pamięć niezaszyfrowana w związku z użytkowaniem Magisk zostanie ponownie zaszyfrowana!</string>
 
     <!--Install-->
     <string name="keep_force_encryption">Zachowaj force encryption (wymuszenie szyfrowania)</string>
@@ -40,23 +40,23 @@
     <string name="install_method_title">Metoda</string>
     <string name="install_next">Dalej</string>
     <string name="install_start">Zaczynajmy</string>
-    <string name="manager_download_install">Naciśnij, aby pobrać i zainstalować</string>
+    <string name="manager_download_install">Kliknij, aby pobrać i zainstalować</string>
     <string name="direct_install">Bezpośrednia instalacja (zalecana)</string>
-    <string name="install_inactive_slot">Zainstaluj w nieaktywnym gnieździe (po OTA)</string>
-    <string name="install_inactive_slot_msg">Po restarcie twoje urządzenie zostanie ZMUSZONE do rozruchu z aktualnie nieaktywnego gniazda!\nUżyj tej opcji wyłącznie po ukończeniu aktualizacji OTA.\nKontynuować?</string>
+    <string name="install_inactive_slot">Zainstaluj w nieaktywnym slocie (po OTA)</string>
+    <string name="install_inactive_slot_msg">Po ponownym uruchomieniu twoje urządzenie zostanie ZMUSZONE do rozruchu z aktualnie nieaktywnego slotu!\nUżywaj tej opcji tylko po ukończeniu aktualizacji OTA.\nKontynuować?</string>
     <string name="setup_title">Dodatkowa konfiguracja</string>
     <string name="select_patch_file">Wybierz i załataj plik</string>
-    <string name="patch_file_msg">Wybierz obraz raw (*.img) lub plik tar ODIN (*.tar)</string>
+    <string name="patch_file_msg">Wybierz obraz raw (*.img) lub plik tar ODIN (*.tar) lub payload.bin (*.bin)</string>
     <string name="reboot_delay_toast">Ponowne uruchomienie za 5 sekund…</string>
     <string name="flash_screen_title">Instalacja</string>
 
     <!--Superuser-->
     <string name="su_request_title">Żądanie dostępu do Superusera</string>
-    <string name="touch_filtered_warning">Ponieważ zapytanie o Superuser aplikacji jest przysłonięte, Magisk nie może zweryfikować twojej odpowiedzi.</string>
+    <string name="touch_filtered_warning">Ponieważ aplikacja zasłania żądanie o Superusera, Magisk nie może zweryfikować twojej odpowiedzi</string>
     <string name="deny">Odmów</string>
     <string name="prompt">Zapytaj</string>
     <string name="grant">Zezwól</string>
-    <string name="su_warning">Udziela pełnego dostępu do urządzenia.\nOdmów jeśli nie jesteś pewien!</string>
+    <string name="su_warning">Udziela pełnego dostępu do urządzenia.\nOdmów, jeżeli nie jesteś pewien!</string>
     <string name="forever">Zawsze</string>
     <string name="once">Raz</string>
     <string name="tenmin">10 min</string>
@@ -66,28 +66,31 @@
     <string name="su_allow_toast">%1$s otrzymał uprawnienia Superusera</string>
     <string name="su_deny_toast">%1$s odmówiono uprawnień Superusera</string>
     <string name="su_snack_grant">Przyznano uprawnienia Superusera dla %1$s</string>
-    <string name="su_snack_deny">Odmówiono uprawnień Superusera dla %1$s</string>
+    <string name="su_snack_deny">Unieważniono uprawnienia Superusera dla %1$s</string>
     <string name="su_snack_notif_on">Włączono powiadomienia dla %1$s</string>
     <string name="su_snack_notif_off">Wyłączono powiadomienia dla %1$s</string>
     <string name="su_snack_log_on">Włączono logowanie dla %1$s</string>
     <string name="su_snack_log_off">Wyłączono logowanie dla %1$s</string>
-    <string name="su_revoke_title">Odwołać?</string>
-    <string name="su_revoke_msg">Potwierdzasz odwołanie uprawnień dla %1$s?</string>
+    <string name="su_revoke_title">Unieważnić?</string>
+    <string name="su_revoke_msg">Potwierdź, aby unieważnić uprawnienia Superusera dla %1$s</string>
     <string name="toast">Wyskakujące powiadomienie</string>
     <string name="none">Brak</string>
 
     <string name="superuser_toggle_notification">Powiadomienia</string>
-    <string name="superuser_toggle_revoke">Odwołaj</string>
+    <string name="superuser_toggle_revoke">Unieważnij</string>
     <string name="superuser_policy_none">Żadna aplikacja nie poprosiła jeszcze o uprawnienia Superusera.</string>
 
     <!--Logs-->
-    <string name="log_data_none">Logi są puste, spróbuj użyć aplikacji wymagających roota.</string>
-    <string name="log_data_magisk_none">Logi Magisk są puste, to jest dziwne.</string>
+    <string name="log_data_none">Nie masz żadnych logów, spróbuj użyć aplikacji wymagających roota</string>
+    <string name="log_data_magisk_none">Logi Magisk są puste, to jest dziwne</string>
     <string name="menuSaveLog">Zapisz log</string>
     <string name="menuClearLog">Wyczyść log</string>
-    <string name="logs_cleared">Log został pomyślnie wyczyszczony.</string>
+    <string name="logs_cleared">Log został pomyślnie wyczyszczony</string>
     <string name="pid">PID: %1$d</string>
     <string name="target_uid">Docelowy UID: %1$d</string>
+    <string name="target_pid">Docelowy PID p.n. montowania: %s</string>
+    <string name="selinux_context">Kontekst SELinux: %s</string>
+    <string name="supp_group">Grupa uzupełniająca: %s</string>
 
     <!--SafetyNet-->
 
@@ -98,7 +101,7 @@
     <string name="hide_search">Szukaj</string>
 
     <!--Module -->
-    <string name="no_info_provided">(Nie umieszczono informacji)</string>
+    <string name="no_info_provided">(Brak informacji)</string>
     <string name="reboot_userspace">Miękki reboot</string>
     <string name="reboot_recovery">Reboot do trybu Recovery</string>
     <string name="reboot_bootloader">Reboot do trybu Bootloader</string>
@@ -109,11 +112,11 @@
     <string name="module_state_restore">Przywróć</string>
     <string name="module_action_install_external">Zainstaluj z pamięci</string>
     <string name="update_available">Dostępna aktualizacja</string>
-    <string name="suspend_text_riru">Moduł uśpiony ponieważ %1$s jest włączony</string>
-    <string name="suspend_text_zygisk">Moduł uśpiony ponieważ %1$s jest wyłączony</string>
-    <string name="zygisk_module_unloaded">Moduł Zygisk nie załadowany ze względu na niekompatybilność</string>
-    <string name="module_empty">Żaden moduł nie jest zainstalowany</string>
-    <string name="confirm_install">Zainstaloać moduł %1$s?</string>
+    <string name="suspend_text_riru">Moduł jest zawieszony, ponieważ %1$s jest włączony</string>
+    <string name="suspend_text_zygisk">Moduł jest zawieszony, ponieważ %1$s nie jest włączony</string>
+    <string name="zygisk_module_unloaded">Moduł Zygisk nie został załadowany z powodu niekompatybilności</string>
+    <string name="module_empty">Brak zainstalowanych modułów</string>
+    <string name="confirm_install">Zainstalować moduł %1$s?</string>
     <string name="confirm_install_title">Potwierdzenie instalacji</string>
 
     <!--Settings -->
@@ -125,7 +128,7 @@
     <string name="settings_download_path_title">Ścieżka pobierania plików</string>
     <string name="settings_download_path_message">Pliki zostaną zapisane do %1$s</string>
     <string name="settings_hide_app_title">Ukryj aplikację Magisk</string>
-    <string name="settings_hide_app_summary">Zainstaluj aplikację z losowym ID pakietu i własną etykietą.</string>
+    <string name="settings_hide_app_summary">Zainstaluj aplikację proxy z losowym ID pakietu i własną etykietą</string>
     <string name="settings_restore_app_title">Przywróć aplikację Magisk</string>
     <string name="settings_restore_app_summary">Przestań ukrywać aplikację i przywróć oryginalny plik APK</string>
     <string name="language">Język</string>
@@ -137,18 +140,18 @@
     <string name="settings_update_beta">Beta</string>
     <string name="settings_update_custom">Własny kanał</string>
     <string name="settings_update_custom_msg">Wprowadź adres URL własnego kanału</string>
-    <string name="settings_zygisk_summary">Uruchom cześć Magiska w zygocie Demona</string>
-    <string name="settings_denylist_title">Wymuś Listę Odmów</string>
-    <string name="settings_denylist_summary">Procesy z Listy Odmów będą miały wszystkie modyfikacje Magisk cofnięte</string>
-    <string name="settings_denylist_error">Ta funkcja wymaga aby %1$s było włączone</string>
-    <string name="settings_denylist_config_title">Ustaw Listę Odmów</string>
-    <string name="settings_denylist_config_summary">Wybierz proces który ma zostać zawarty w Liście Odmów</string>
+    <string name="settings_zygisk_summary">Uruchom część Magisk w demonie zygote</string>
+    <string name="settings_denylist_title">Egzekwowanie listy odmów (DenyList)</string>
+    <string name="settings_denylist_summary">Procesy znajdujące się na liście odmów (DenyList) będą miały cofnięte wszystkie modyfikacje Magisk</string>
+    <string name="settings_denylist_error">Ta funkcja wymaga, aby %1$s było włączone</string>
+    <string name="settings_denylist_config_title">Konfiguracja listy odmów (DenyList)</string>
+    <string name="settings_denylist_config_summary">Wybierz procesy, które mają się znajdować na liście odmów (DenyList)</string>
     <string name="settings_hosts_title">Hosty Systemless</string>
-    <string name="settings_hosts_summary">Wsparcie hostów Systemless dla aplikacji typu Adblock</string>
+    <string name="settings_hosts_summary">Wsparcie hostów Systemless dla aplikacji blokujących reklamy</string>
     <string name="settings_hosts_toast">Dodano moduł hostów Systemless</string>
     <string name="settings_app_name_hint">Nowa nazwa</string>
-    <string name="settings_app_name_helper">Aplikacja zostanie przepakowana do tej nazwy</string>
-    <string name="settings_app_name_error">Błędny format</string>
+    <string name="settings_app_name_helper">Aplikacja zostanie przepakowana z tą nazwą</string>
+    <string name="settings_app_name_error">Nieprawidłowy format</string>
     <string name="settings_su_app_adb">Aplikacje i ADB</string>
     <string name="settings_su_app">Tylko aplikacje</string>
     <string name="settings_su_adb">Tylko ADB</string>
@@ -164,23 +167,23 @@
     <string name="request_timeout">Limit czasu żądania</string>
     <string name="superuser_notification">Powiadomienia Superusera</string>
     <string name="settings_su_reauth_title">Ponowienie uwierzytelniania po aktualizacji</string>
-    <string name="settings_su_reauth_summary">Ponowienie dostępu do uprawnień Superusera po uaktualnieniu aplikacji</string>
-    <string name="settings_su_tapjack_title">Włącz ochronę przed Tapjacking (niezamierzone kliknięcie)</string>
-    <string name="settings_su_tapjack_summary">Pytanie o Superuser nie będzie reagować na odpowiedź jeżeli będzie zasłonięte lub przyćmione.</string>
-    <string name="settings_su_biometric_title">Uwierzytelnianie biometryczne</string>
-    <string name="settings_su_biometric_summary">Używaj uwierzytelniania biometrycznego (np. odcisku palca) aby przyznać uprawnienia Superusera</string>
-    <string name="no_biometric">Urządzenie jest nieobsługiwane lub ustawienia biometryczne nie są włączone</string>
+    <string name="settings_su_reauth_summary">Zapytaj ponownie o uprawnienia Superusera po uaktualnieniu aplikacji</string>
+    <string name="settings_su_tapjack_title">Ochrona przed Tapjackingiem (niezamierzonym kliknięciem)</string>
+    <string name="settings_su_tapjack_summary">Okno dialogowe z żądaniem Superusera nie będzie reagować na odpowiedź, jeżeli będzie zasłonięte przez inne okno lub nakładkę</string>
+    <string name="settings_su_auth_title">Uwierzytelnianie użytkownika</string>
+    <string name="settings_su_auth_summary">Pytaj o uwierzytelnienie użytkownika podczas żądań Superusera</string>
+    <string name="settings_su_auth_insecure">Nie skonfigurowano żadnej metody uwierzytelniania na tym urządzeniu</string>
     <string name="settings_customization">Personalizacja</string>
-    <string name="setting_add_shortcut_summary">Dodaj ładny skrót na ekranie głównym na wypadek, gdyby nazwa i ikona były trudne do rozpoznania po ukryciu aplikacji</string>
+    <string name="setting_add_shortcut_summary">Umieść ładny skrót na ekranie głównym na wypadek, gdyby nazwa i ikona były trudne do rozpoznania po ukryciu aplikacji</string>
     <string name="settings_doh_title">DNS over HTTPS</string>
     <string name="settings_doh_description">Zapobiegaj zatruwaniu DNS (DNS poisoning) w niektórych krajach</string>
 
     <string name="multiuser_mode">Tryb wielu użytkowników (Multiuser)</string>
     <string name="settings_owner_only">Tylko właściciel urządzenia</string>
     <string name="settings_owner_manage">Zarządzanie przez właściciela urządzenia</string>
-    <string name="settings_user_independent">Niezależni użytkownicy</string>
+    <string name="settings_user_independent">Niezależne ustawienia użytkowników</string>
     <string name="owner_only_summary">Tylko właściciel ma dostęp do roota</string>
-    <string name="owner_manage_summary">Tylko właściciel może zarządzać ustawieniami dostępu do roota i otrzymywać żądania dostępu</string>
+    <string name="owner_manage_summary">Tylko właściciel może zarządzać dostępem do roota i otrzymywać żądania dostępu do roota</string>
     <string name="user_independent_summary">Każdy użytkownik ma niezależne ustawienia dostępu do roota</string>
 
     <string name="mount_namespace_mode">Tryb przestrzeni nazw montowania</string>
@@ -188,7 +191,7 @@
     <string name="settings_ns_requester">Dziedziczona przestrzeń nazw</string>
     <string name="settings_ns_isolate">Izolowana przestrzeń nazw</string>
     <string name="global_summary">Wszystkie sesje roota będą używać globalnej przestrzeni nazw montowania</string>
-    <string name="requester_summary">Sesje roota odziedziczą przestrzeń nazw od żądającego</string>
+    <string name="requester_summary">Sesje roota odziedziczą przestrzeń nazw żądającego dostępu</string>
     <string name="isolate_summary">Każda sesja roota otrzyma własną, izolowaną przestrzeń nazw</string>
 
     <!--Notifications-->
@@ -199,7 +202,7 @@
     <string name="download_file_error">Błąd pobierania pliku</string>
     <string name="magisk_update_title">Aktualizacja Magisk dostępna!</string>
     <string name="updated_title">Magisk zaktualizowany</string>
-    <string name="updated_text">Naciśnij aby otworzyć applikację</string>
+    <string name="updated_text">Kliknij, aby otworzyć aplikację</string>
 
     <!--Toasts, Dialogs-->
     <string name="yes">Tak</string>
@@ -211,7 +214,7 @@
     <string name="flashing">Flashowanie…</string>
     <string name="done">Gotowe!</string>
     <string name="failure">Błąd</string>
-    <string name="hide_app_title">Ukrywam aplikację Magisk…</string>
+    <string name="hide_app_title">Ukrywanie aplikacji Magisk…</string>
     <string name="open_link_failed_toast">Nie znaleziono aplikacji do otwarcia linku</string>
     <string name="complete_uninstall">Odinstaluj całkowicie</string>
     <string name="restore_img">Przywróć obrazy</string>
@@ -219,26 +222,26 @@
     <string name="restore_done">Przywracanie zakończone!</string>
     <string name="restore_fail">Kopia zapasowa nie istnieje!</string>
     <string name="setup_fail">Konfiguracja nieudana</string>
-    <string name="env_fix_title">Wymaga dodatkowej konfiguracji</string>
-    <string name="env_fix_msg">Twoje urządzenie wymaga dodatkowej konfiguracji aby Magisk działał właściwie. Czy chcesz kontynuować i uruchomić ponownie?</string>
-    <string name="env_full_fix_msg">Twoje urządzenie musi wgrać ponowanie Magisk, aby działać poprawnie. Proszę przeinstaluj Magisk w aplikacji, tryb Recovery nie potrafi poprawnie rozpoznać urządzenia.</string>
+    <string name="env_fix_title">Wymagana dodatkowa konfiguracja</string>
+    <string name="env_fix_msg">Twoje urządzenie wymaga dodatkowej konfiguracji, aby Magisk działał poprawnie. Czy chcesz kontynuować i uruchomić ponownie?</string>
+    <string name="env_full_fix_msg">Twoje urządzenie wymaga ponownej instalacji Magisk, aby działać poprawnie. Zainstaluj ponownie Magisk używając aplikacji, tryb recovery nie może uzyskać prawidłowych informacji o urządzeniu.</string>
     <string name="setup_msg">Uruchamianie środowiska konfiguracji…</string>
     <string name="authenticate">Uwierzytelnianie</string>
     <string name="unsupport_magisk_title">Nieobsługiwana wersja Magisk</string>
-    <string name="unsupport_magisk_msg">Ta wersja aplikacji nie obsługuje Magisk w wersji niższej niż %1$s.\n\nAplikacja będzie zachowywać się tak jakby Magisk nie był zainstalowany, proszę uaktualnij Magisk.</string>
+    <string name="unsupport_magisk_msg">Ta wersja aplikacji nie obsługuje Magisk w wersji niższej niż %1$s.\n\nAplikacja będzie zachowywać się tak, jakby Magisk nie był zainstalowany, zaktualizuj Magisk tak szybko, jak to możliwe.</string>
     <string name="unsupport_general_title">Nieprawidłowy stan</string>
-    <string name="unsupport_system_app_msg">Uruchomienie tej aplikacji jako systemowa nie jest obsługiwane. Proszę przemienić ją na aplikację użytkownika.</string>
-    <string name="unsupport_other_su_msg">Wykryto komendę \"su\" nie należącą do Magisk. Proszę usunąć tę drugą aplikację \"su\".</string>
-    <string name="unsupport_external_storage_msg">Zainstalowano Magisk na pamięci zewnętrznej. Proszę przenieść ją na pamięć wewnętrzną.</string>
-    <string name="unsupport_nonroot_stub_msg">Ta aplikacja nie może dłużej działać w trybie ukrycia jako że root został utracony. Proszę przywrócić ją do oryginalnego stanu.</string>
+    <string name="unsupport_system_app_msg">Uruchomienie tej aplikacji jako aplikacja systemowa nie jest obsługiwane. Przywróć aplikację do stanu aplikacji użytkownika.</string>
+    <string name="unsupport_other_su_msg">Wykryto plik binarny \"su\" nie należący do Magisk. Usuń wszelkie konkurencyjne rozwiązania root i/lub zainstaluj ponownie Magisk.</string>
+    <string name="unsupport_external_storage_msg">Magisk jest zainstalowany w pamięci zewnętrznej. Przenieś aplikację do pamięci wewnętrznej.</string>
+    <string name="unsupport_nonroot_stub_msg">Ukryta aplikacja Magisk nie może dłużej działać, ponieważ uprawnienia roota zostały utracone. Przywróć oryginalny plik APK.</string>
     <string name="unsupport_nonroot_stub_title">@string/settings_restore_app_title</string>
-    <string name="external_rw_permission_denied">Zezwól na dostęp do pamięci wewnętrznej, aby włączyć tę funkcję.</string>
-    <string name="post_notifications_denied">Zezwól na otrzymywanie powiadomień, aby aktywować tą funkcję</string>
-    <string name="install_unknown_denied">Zezwól na "Instaluj z nieznanych źródeł" by włączyć tą funkcję</string>
+    <string name="external_rw_permission_denied">Zezwól na dostęp do pamięci, aby włączyć tę funkcję</string>
+    <string name="post_notifications_denied">Zezwól na otrzymywanie powiadomień, aby włączyć tę funkcję</string>
+    <string name="install_unknown_denied">Zezwól na \"Instaluj z nieznanych źródeł\", aby włączyć tę funkcję</string>
     <string name="add_shortcut_title">Utwórz skrót na ekranie głównym</string>
     <string name="add_shortcut_msg">Po ukryciu tej aplikacji, jej nazwa i ikona może być trudna do rozpoznania. Czy chcesz dodać ładny skrót na ekranie głównym?</string>
     <string name="app_not_found">Nie znaleziono aplikacji do wykonania tej czynności</string>
-    <string name="reboot_apply_change">Uruchom ponownie by zastosować zmiany</string>
-    <string name="restore_app_confirmation">To przywróci ukrytą aplikację z powrotem do orginalnej aplikacji. Czy na pewno chcesz to zrobić?</string>
+    <string name="reboot_apply_change">Uruchom ponownie, aby zastosować zmiany</string>
+    <string name="restore_app_confirmation">Spowoduje to przywrócenie ukrytej aplikacji z powrotem do stanu oryginalnej aplikacji. Czy na pewno chcesz to zrobić?</string>
 
 </resources>

app/src/main/res/values-pt-rBR/strings.xml

@@ -6,20 +6,20 @@
     <string name="logs">Registros</string>
     <string name="settings">Configurações</string>
     <string name="install">Instalar</string>
-    <string name="section_home">Resumo</string>
+    <string name="section_home">Início</string>
     <string name="section_theme">Temas</string>
-    <string name="denylist">Lista de Negação</string>
+    <string name="denylist">Lista de negação</string>
 
     <!--Home-->
     <string name="no_connection">Nenhuma conexão disponível</string>
     <string name="app_changelog">Registro de alterações</string>
     <string name="loading">Carregando…</string>
     <string name="update">Atualizar</string>
-    <string name="not_available">N/A</string>
+    <string name="not_available">Não disponível</string>
     <string name="hide">Ocultar</string>
     <string name="home_package">Pacote</string>
     <string name="home_app_title">App</string>
-    <string name="home_notice_content">Baixe o Magisk SOMENTE pela página oficial do Github. Arquivos de fontes desconhecidas podem ser maliciosos e danificar seu aparelho.</string>
+    <string name="home_notice_content">Baixe o Magisk SOMENTE pela página oficial do GitHub. Arquivos de fontes desconhecidas podem ser maliciosos e podem danificar seu aparelho!</string>
     <string name="home_support_title">Apoie</string>
     <string name="home_follow_title">Siga</string>
     <string name="home_item_source">Fonte</string>
@@ -28,13 +28,13 @@
     <string name="home_latest_version">Recente</string>
     <string name="invalid_update_channel">Canal de atualização inválido</string>
     <string name="uninstall_magisk_title">Desinstalar Magisk</string>
-    <string name="uninstall_magisk_msg">Todos os módulos serão desativados/removidos!\nA raiz será removida!\nSeus dados não criptografados devido uso do Magisk, serão re-criptografados!</string>
+    <string name="uninstall_magisk_msg">Todos os módulos serão desativados/removidos!\nO root será removido!\nSeus dados não criptografados devido ao uso do Magisk, serão re-criptografados!</string>
 
     <!--Install-->
     <string name="keep_force_encryption">Manter criptografia forçada</string>
     <string name="keep_dm_verity">Manter AVB 2.0/dm-verity</string>
     <string name="patch_vbmeta">Corrigir vbmeta na imagem de boot</string>
-    <string name="recovery_mode">Modo de recuperação</string>
+    <string name="recovery_mode">Modo Recovery</string>
     <string name="install_options_title">Opções</string>
     <string name="install_method_title">Método</string>
     <string name="install_next">Próximo</string>
@@ -51,7 +51,7 @@
 
     <!--Superuser-->
     <string name="su_request_title">Solicitação de SuperUsuário</string>
-    <string name="touch_filtered_warning">Devido um app estar obscurecendo a solicitação de SuperUsuário, o Magisk não pode conferir suas resposta</string>
+    <string name="touch_filtered_warning">Como um app está ocultando uma solicitação de SuperUsuário, o Magisk não pode verificar sua resposta.</string>
     <string name="deny">Negar</string>
     <string name="prompt">Perguntar</string>
     <string name="grant">Permitir</string>
@@ -62,28 +62,28 @@
     <string name="twentymin">20 mins</string>
     <string name="thirtymin">30 mins</string>
     <string name="sixtymin">60 mins</string>
-    <string name="su_allow_toast">%1$s foi permitido o acesso SuperUsuário</string>
-    <string name="su_deny_toast">%1$s foi negado o acesso SuperUsuário</string>
+    <string name="su_allow_toast">%1$s foi permitido o acesso de SuperUsuário</string>
+    <string name="su_deny_toast">%1$s foi negado o acesso de SuperUsuário</string>
     <string name="su_snack_grant">Os acessos de SuperUsuário de %1$s foram permitidos</string>
     <string name="su_snack_deny">Os acessos de SuperUsuário de %1$s foram negados</string>
     <string name="su_snack_notif_on">As notificações de %1$s foram ativadas</string>
     <string name="su_snack_notif_off">As notificações de %1$s foram desativadas</string>
     <string name="su_snack_log_on">Os registros de %1$s foram ativados</string>
     <string name="su_snack_log_off">Os registros de %1$s foram desativados</string>
-    <string name="su_revoke_title">Remover?</string>
-    <string name="su_revoke_msg">Confirmar a remoção do acesso de %1$s?</string>
+    <string name="su_revoke_title">Revogar?</string>
+    <string name="su_revoke_msg">Confirmar a remoção do acesso de SuperUsuário de %1$s?</string>
     <string name="toast">Notificação (Pop-up)</string>
     <string name="none">Nenhum</string>
     <string name="superuser_toggle_notification">Notificações</string>
-    <string name="superuser_toggle_revoke">Remover</string>
-    <string name="superuser_policy_none">Nenhum app solicitou permissão de SuperUsuário ainda.</string>
+    <string name="superuser_toggle_revoke">Revogar</string>
+    <string name="superuser_policy_none">Nenhum app solicitou permissão de SuperUsuário ainda</string>
 
     <!--Logs-->
-    <string name="log_data_none">Não há registros. Tente usar os apps permitidos para SuperUsuário.</string>
-    <string name="log_data_magisk_none">Os Registro de atividade do Magisk estão vazios, isso é estranho.</string>
-    <string name="menuSaveLog">Salvar Registro</string>
-    <string name="menuClearLog">Limpar Registro agora</string>
-    <string name="logs_cleared">Registro limpo com sucesso.</string>
+    <string name="log_data_none">Não há registros. Tente usar mais seus apps root.</string>
+    <string name="log_data_magisk_none">Os registros do Magisk estão vazios, isso é estranho.</string>
+    <string name="menuSaveLog">Salvar registros</string>
+    <string name="menuClearLog">Limpar registros agora</string>
+    <string name="logs_cleared">Registros limpo com sucesso</string>
     <string name="pid">PID: %1$d</string>
     <string name="target_uid">Alvo UID: %1$d</string>
     <string name="target_pid">Alvo PID: %s</string>
@@ -91,10 +91,10 @@
     <string name="supp_group">Grupo suplementar: %s</string>
 
     <!--MagiskHide-->
-    <string name="show_system_app">Mostrar apps do Sistema</string>
-    <string name="show_os_app">Mostrar apps do Sistema</string>
+    <string name="show_system_app">Mostrar apps do sistema</string>
+    <string name="show_os_app">Mostrar apps do sistema operacional</string>
     <string name="hide_filter_hint">Filtrar pelo nome</string>
-    <string name="hide_search">Pesquisa</string>
+    <string name="hide_search">Pesquisar</string>
 
     <!--Module-->
     <string name="no_info_provided">(Nenhuma informação fornecida)</string>
@@ -108,48 +108,48 @@
     <string name="module_state_restore">Restaurar</string>
     <string name="module_action_install_external">Instalar a partir do armazenamento</string>
     <string name="update_available">Atualização disponível</string>
-    <string name="suspend_text_riru">Módulo suspenso porque %1$s está ativo</string>
-    <string name="suspend_text_zygisk">Módulo suspenso porque %1$s não está ativo</string>
+    <string name="suspend_text_riru">Módulo suspenso porque %1$s está ativado</string>
+    <string name="suspend_text_zygisk">Módulo suspenso porque %1$s não está ativado</string>
     <string name="zygisk_module_unloaded">Modulo Zygisk não carregado devido a incompatibilidade</string>
     <string name="module_empty">Nenhum módulo instalado</string>
     <string name="confirm_install">Instalar módulo %1$s?</string>
-    <string name="confirm_install_title">Confirmação de Instalação</string>
+    <string name="confirm_install_title">Confirmação de instalação</string>
 
     <!--Settings-->
-    <string name="settings_dark_mode_title">Modo de tema</string>
+    <string name="settings_dark_mode_title">Modo do tema</string>
     <string name="settings_dark_mode_message">Selecione o modo mais adequado ao seu estilo!</string>
-    <string name="settings_dark_mode_light">Sempre Claro</string>
-    <string name="settings_dark_mode_system">Baseado no Sistema</string>
-    <string name="settings_dark_mode_dark">Sempre Escuro</string>
-    <string name="settings_download_path_title">Caminho para Baixar</string>
+    <string name="settings_dark_mode_light">Sempre claro</string>
+    <string name="settings_dark_mode_system">Mesmo do sistema</string>
+    <string name="settings_dark_mode_dark">Sempre escuro</string>
+    <string name="settings_download_path_title">Caminho para baixar</string>
     <string name="settings_download_path_message">Os arquivos serão salvos em %1$s</string>
     <string name="settings_hide_app_title">Ocultar o app do Magisk</string>
     <string name="settings_hide_app_summary">Instala o app oculto com ID aleatório e nome personalizado</string>
-    <string name="settings_restore_app_title">Restaurar o App do Magisk</string>
+    <string name="settings_restore_app_title">Restaurar o app do Magisk</string>
     <string name="settings_restore_app_summary">Desoculta o app do Magisk e restaura o APK original</string>
     <string name="language">Idioma</string>
     <string name="system_default">(Padrão do sistema)</string>
-    <string name="settings_check_update_title">Ativar Verificação de Atualizações</string>
-    <string name="settings_check_update_summary">Verifica periodicamente em segundo plano se há atualizações</string>
-    <string name="settings_update_channel_title">Canal de Atualização</string>
+    <string name="settings_check_update_title">Verificar atualizações</string>
+    <string name="settings_check_update_summary">Verifica periodicamente se há atualizações em segundo plano</string>
+    <string name="settings_update_channel_title">Canal de atualização</string>
     <string name="settings_update_stable">Estável</string>
     <string name="settings_update_beta">Beta</string>
-    <string name="settings_update_custom">Canal Personalizado</string>
-    <string name="settings_update_custom_msg">Insira um URL personalizado</string>
+    <string name="settings_update_custom">Personalizado</string>
+    <string name="settings_update_custom_msg">Insira um URL de canal personalizado</string>
     <string name="settings_zygisk_summary">Executa partes do Magisk no Zygote</string>
-    <string name="settings_denylist_title">Forçar Aplicação da Lista de Negação</string>
-    <string name="settings_denylist_summary">Os processos na lista de negação terão revertidas todas as modificações feitas pelo Magisk</string>
+    <string name="settings_denylist_title">Aplicar Lista de negação</string>
+    <string name="settings_denylist_summary">Os processos na Lista de negação terão todas as modificações do Magisk revertidas</string>
     <string name="settings_denylist_error">Isso requer %1$s para ser ativado</string>
-    <string name="settings_denylist_config_title">Configurar Lista de Negação</string>
-    <string name="settings_denylist_config_summary">Selecione os processos a serem incluídos na lista de negação</string>
-    <string name="settings_hosts_title">Ativar /etc/hosts systemless</string>
-    <string name="settings_hosts_summary">Suporte de /etc/hosts fora do sistema para aplicativos Adblock</string>
-    <string name="settings_hosts_toast">Adicionado módulo do /etc/hosts systemless</string>
+    <string name="settings_denylist_config_title">Configurar Lista de negação</string>
+    <string name="settings_denylist_config_summary">Selecione os processos a serem incluídos na Lista de negação</string>
+    <string name="settings_hosts_title">Hosts fora do sistema</string>
+    <string name="settings_hosts_summary">Suporte de /etc/hosts fora do sistema para apps Adblock</string>
+    <string name="settings_hosts_toast">Adicionado módulo de /etc/hosts fora do sistema</string>
     <string name="settings_app_name_hint">Novo nome</string>
     <string name="settings_app_name_helper">O app do Magisk será reinstalado com este nome</string>
     <string name="settings_app_name_error">Formato inválido</string>
-    <string name="settings_su_app_adb">Aplicativos e ADB</string>
-    <string name="settings_su_app">Apenas aplicativos</string>
+    <string name="settings_su_app_adb">Apps e ADB</string>
+    <string name="settings_su_app">Apenas apps</string>
     <string name="settings_su_adb">Apenas ADB</string>
     <string name="settings_su_disable">Desativado</string>
     <string name="settings_su_request_10">10 segundos</string>
@@ -160,33 +160,33 @@
     <string name="settings_su_request_60">60 segundos</string>
     <string name="superuser_access">Acesso de SuperUsuário</string>
     <string name="auto_response">Resposta automática</string>
-    <string name="request_timeout">Tempo Limite da Solicitação</string>
+    <string name="request_timeout">Tempo limite da solicitação</string>
     <string name="superuser_notification">Notificação de SuperUsuário</string>
-    <string name="settings_su_reauth_title">Autenticar novamente após a atualização</string>
-    <string name="settings_su_reauth_summary">Reautenticar permissões de SuperUsuário após atualizar aplicativo</string>
-    <string name="settings_su_tapjack_title">Ativar Proteção Contra Atividades Sobrepostas</string>
-    <string name="settings_su_tapjack_summary">A caixa de diálogo do SuperUsuário não responderá à entrada enquanto estiver obscurecida por qualquer outra janela ou sobreposição</string>
-    <string name="settings_su_biometric_title">Ativar Autenticação Biométrica</string>
-    <string name="settings_su_biometric_summary">Use a autenticação biométrica para permitir solicitações de SuperUsuário</string>
-    <string name="no_biometric">Dispositivo não suportado ou nenhuma configuração biométrica está ativada</string>
+    <string name="settings_su_reauth_title">Reautenticar após atualização</string>
+    <string name="settings_su_reauth_summary">Reautenticar permissões de SuperUsuário após atualizar os apps</string>
+    <string name="settings_su_tapjack_title">Proteção contra atividades sobrepostas</string>
+    <string name="settings_su_tapjack_summary">A caixa de diálogo do SuperUsuário não responderá à entrada enquanto estiver oculta por qualquer outra janela ou sobreposição</string>
+    <string name="settings_su_auth_title">Autenticação de usuário</string>
+    <string name="settings_su_auth_summary">Solicite autenticação de usuário durante solicitações de SuperUsuário</string>
+    <string name="settings_su_auth_insecure">Nenhum método de autenticação está configurado no dispositivo</string>
     <string name="settings_customization">Personalizações</string>
-    <string name="setting_add_shortcut_summary">Adicione um atalho na tela inicial, caso o nome e o ícone sejam difíceis de reconhecer logo após ocultar o aplicativo</string>
-    <string name="settings_doh_title">Ativar DNS sobre HTTPS</string>
+    <string name="setting_add_shortcut_summary">Adicione um atalho na tela inicial, caso o nome e o ícone sejam difíceis de reconhecer logo após ocultar o app.</string>
+    <string name="settings_doh_title">DNS sobre HTTPS</string>
     <string name="settings_doh_description">Solução alternativa para envenenamento de DNS em alguns países</string>
-    <string name="multiuser_mode">Ativar Modo Multiusuário</string>
+    <string name="multiuser_mode">Modo Multiusuário</string>
     <string name="settings_owner_only">Somente proprietário do dispositivo</string>
     <string name="settings_owner_manage">Gerenciado pelo proprietário do dispositivo</string>
     <string name="settings_user_independent">Independente do usuário</string>
-    <string name="owner_only_summary">Somente o proprietário tem acesso ao SuperUsuário</string>
-    <string name="owner_manage_summary">Somente o proprietário pode gerenciar o acesso do SuperUsuário e receber pedidos de solicitação</string>
+    <string name="owner_only_summary">Somente o proprietário tem acesso root</string>
+    <string name="owner_manage_summary">Somente o proprietário pode gerenciar o acesso root e receber pedidos de solicitação</string>
     <string name="user_independent_summary">Cada usuário tem suas próprias regras de root separadas</string>
-    <string name="mount_namespace_mode">Ativar Modo Namespace</string>
+    <string name="mount_namespace_mode">Montar modo Namespace</string>
     <string name="settings_ns_global">Namespace global</string>
     <string name="settings_ns_requester">Herdar Namespace</string>
     <string name="settings_ns_isolate">Namespace isolado</string>
     <string name="global_summary">Todas as sessões root usam o namespace de montagem global</string>
     <string name="requester_summary">As sessões root herdarão o namespace do solicitante</string>
-    <string name="isolate_summary">Cada sessão do SuperUsuário terá seu próprio namespace isolado</string>
+    <string name="isolate_summary">Cada sessão root terá seu próprio namespace isolado</string>
 
     <!--Notifications-->
     <string name="update_channel">Atualizações do Magisk</string>
@@ -194,8 +194,8 @@
     <string name="updated_channel">Atualização concluída</string>
     <string name="download_complete">Download concluído</string>
     <string name="download_file_error">Erro ao baixar arquivo</string>
-    <string name="magisk_update_title">Nova atualização do Magisk disponível!</string>
-    <string name="updated_title">Magisk Atualizado</string>
+    <string name="magisk_update_title">Atualização do Magisk disponível!</string>
+    <string name="updated_title">Magisk atualizado</string>
     <string name="updated_text">Toque para abrir o app</string>
 
     <!--Toasts, Dialogs-->
@@ -205,35 +205,35 @@
     <string name="download">Baixar</string>
     <string name="reboot">Reiniciar</string>
     <string name="release_notes">Notas da atualização</string>
-    <string name="flashing">Fazendo Flash…</string>
+    <string name="flashing">Flashando…</string>
     <string name="done">Concluído!</string>
-    <string name="failure">Falha</string>
+    <string name="failure">Falha!</string>
     <string name="hide_app_title">Ocultando o app do Magisk…</string>
     <string name="open_link_failed_toast">Nenhum app encontrado para abrir o link</string>
     <string name="complete_uninstall">Desinstalação completa</string>
     <string name="restore_img">Restaurar imagens</string>
     <string name="restore_img_msg">Restaurando…</string>
     <string name="restore_done">Restauração concluída!</string>
-    <string name="restore_fail">O backup original não foi encontrado!</string>
+    <string name="restore_fail">O backup original não existe!</string>
     <string name="setup_fail">Falha na instalação</string>
     <string name="env_fix_title">Configuração adicional exigida</string>
     <string name="env_fix_msg">Seu dispositivo exige uma configuração adicional para o Magisk funcionar corretamente. Deseja continuar e reiniciar?</string>
-    <string name="env_full_fix_msg">Seu dispositivo precisa refazer o flash do Magisk para funcionar corretamente. Reinstale o Magisk no aplicativo, o modo de recuperação não pode obter as devidas informações do dispositivo.</string>
+    <string name="env_full_fix_msg">Seu dispositivo precisa refazer o flash do Magisk para funcionar corretamente. Por favor, reinstale o Magisk no app, o modo Recovery não pode obter as devidas informações do dispositivo.</string>
     <string name="setup_msg">Executando a configuração do ambiente…</string>
     <string name="authenticate">Autenticar</string>
     <string name="unsupport_magisk_title">Versão do Magisk não suportada</string>
-    <string name="unsupport_magisk_msg">Essa versão do app não suporta versão do Magisk inferior a %1$s.\n\nO app irá se comportar como se nenhum Magisk estivesse sido instalado. Por favor, atualize o Magisk assim que possível.</string>
-    <string name="unsupport_general_title">Estado Anormal</string>
-    <string name="unsupport_system_app_msg">Não há suporte para executar este app como um app do sistema. Por favor, reverta o app para um app do usuário.</string>
+    <string name="unsupport_magisk_msg">Esta versão do app não suporta a versão do Magisk inferior a %1$s.\n\nO app irá se comportar como se nenhum Magisk estivesse sido instalado. Por favor, atualize o Magisk assim que possível.</string>
+    <string name="unsupport_general_title">Estado anormal</string>
+    <string name="unsupport_system_app_msg">Não há suporte para executar este app como um app do sistema. Por favor, reverta o app para um app de usuário.</string>
     <string name="unsupport_other_su_msg">Não foi possível detectar o binário \"su\" do Magisk. Por favor, remova qualquer outro root concorrente e/ou reinstale o Magisk.</string>
-    <string name="unsupport_external_storage_msg">O app do Magisk está instalado no armazenamento externo, Por favor, mova o app para o armazenamento interno.</string>
-    <string name="unsupport_nonroot_stub_msg">O app oculto do Magisk não pode continuar a funcionar porque o SuperUsuário foi perdido. Por favor, restaure o APK original.</string>
+    <string name="unsupport_external_storage_msg">O app do Magisk está instalado no armazenamento externo. Por favor, mova o app para o armazenamento interno.</string>
+    <string name="unsupport_nonroot_stub_msg">O app oculto do Magisk não pode continuar funcionando porque o root foi perdido. Por favor, restaure o APK original.</string>
     <string name="unsupport_nonroot_stub_title">@string/settings_restore_app_title</string>
-    <string name="external_rw_permission_denied">Autorize a permissão de armazenamento para ativar esta funcionalidade</string>
-    <string name="post_notifications_denied">Autorize a permissão de notificaçoes para ativar esta funcionalidade</string>
-    <string name="install_unknown_denied">Permita a "instalação apps desconhecidos" para ativar esta funcionalidade</string>
-    <string name="add_shortcut_title">Adicionar Atalho à Tela Inicial</string>
-    <string name="add_shortcut_msg">Depois de ocultar o app do Magisk, o seu nome e ícone ficarão difíceis de reconhecer. Deseja adicionar um atalho na tela inicial?</string>
+    <string name="external_rw_permission_denied">Conceda permissão de armazenamento para ativar esta funcionalidade</string>
+    <string name="post_notifications_denied">Conceda permissão às notificações para ativar esta funcionalidade</string>
+    <string name="install_unknown_denied">Permita a opção "Instalar apps de fontes desconhecidas" para ativar esta funcionalidade</string>
+    <string name="add_shortcut_title">Adicionar atalho à tela inicial</string>
+    <string name="add_shortcut_msg">Após ocultar o app do Magisk, seu nome e ícone ficarão difíceis de reconhecer. Deseja adicionar um atalho na tela inicial?</string>
     <string name="app_not_found">Nenhum app encontrado para realizar esta ação</string>
     <string name="reboot_apply_change">Reinicie para aplicar as mudanças</string>
     <string name="restore_app_confirmation">Isso irá restaurar o app oculto do Magisk de volta para o app original. Deseja realmente fazer isso?</string>

app/src/main/res/values-pt-rPT/strings.xml

@@ -6,20 +6,20 @@
     <string name="logs">Registros</string>
     <string name="settings">Configurações</string>
     <string name="install">Instalar</string>
-    <string name="section_home">Resumo</string>
+    <string name="section_home">Início</string>
     <string name="section_theme">Temas</string>
-    <string name="denylist">Lista de Negação</string>
+    <string name="denylist">Lista de negação</string>
 
     <!--Home-->
     <string name="no_connection">Nenhuma conexão disponível</string>
     <string name="app_changelog">Registro de alterações</string>
     <string name="loading">Carregando…</string>
     <string name="update">Atualizar</string>
-    <string name="not_available">N/A</string>
+    <string name="not_available">Não disponível</string>
     <string name="hide">Ocultar</string>
     <string name="home_package">Pacote</string>
     <string name="home_app_title">App</string>
-    <string name="home_notice_content">Baixe o Magisk SOMENTE pela página oficial do Github. Arquivos de fontes desconhecidas podem ser maliciosos e danificar seu aparelho.</string>
+    <string name="home_notice_content">Baixe o Magisk SOMENTE pela página oficial do GitHub. Arquivos de fontes desconhecidas podem ser maliciosos e podem danificar seu aparelho!</string>
     <string name="home_support_title">Apoie</string>
     <string name="home_follow_title">Siga</string>
     <string name="home_item_source">Fonte</string>
@@ -28,13 +28,13 @@
     <string name="home_latest_version">Recente</string>
     <string name="invalid_update_channel">Canal de atualização inválido</string>
     <string name="uninstall_magisk_title">Desinstalar Magisk</string>
-    <string name="uninstall_magisk_msg">Todos os módulos serão desativados/removidos!\nA raiz será removida!\nSeus dados não criptografados devido uso do Magisk, serão re-criptografados!</string>
+    <string name="uninstall_magisk_msg">Todos os módulos serão desativados/removidos!\nO root será removido!\nSeus dados não criptografados devido ao uso do Magisk, serão re-criptografados!</string>
 
     <!--Install-->
     <string name="keep_force_encryption">Manter criptografia forçada</string>
     <string name="keep_dm_verity">Manter AVB 2.0/dm-verity</string>
     <string name="patch_vbmeta">Corrigir vbmeta na imagem de boot</string>
-    <string name="recovery_mode">Modo de recuperação</string>
+    <string name="recovery_mode">Modo Recovery</string>
     <string name="install_options_title">Opções</string>
     <string name="install_method_title">Método</string>
     <string name="install_next">Próximo</string>
@@ -51,7 +51,7 @@
 
     <!--Superuser-->
     <string name="su_request_title">Solicitação de SuperUsuário</string>
-    <string name="touch_filtered_warning">Devido um app estar obscurecendo a solicitação de SuperUsuário, o Magisk não pode conferir suas resposta</string>
+    <string name="touch_filtered_warning">Como um app está ocultando uma solicitação de SuperUsuário, o Magisk não pode verificar sua resposta.</string>
     <string name="deny">Negar</string>
     <string name="prompt">Perguntar</string>
     <string name="grant">Permitir</string>
@@ -62,28 +62,28 @@
     <string name="twentymin">20 mins</string>
     <string name="thirtymin">30 mins</string>
     <string name="sixtymin">60 mins</string>
-    <string name="su_allow_toast">%1$s foi permitido o acesso SuperUsuário</string>
-    <string name="su_deny_toast">%1$s foi negado o acesso SuperUsuário</string>
+    <string name="su_allow_toast">%1$s foi permitido o acesso de SuperUsuário</string>
+    <string name="su_deny_toast">%1$s foi negado o acesso de SuperUsuário</string>
     <string name="su_snack_grant">Os acessos de SuperUsuário de %1$s foram permitidos</string>
     <string name="su_snack_deny">Os acessos de SuperUsuário de %1$s foram negados</string>
     <string name="su_snack_notif_on">As notificações de %1$s foram ativadas</string>
     <string name="su_snack_notif_off">As notificações de %1$s foram desativadas</string>
     <string name="su_snack_log_on">Os registros de %1$s foram ativados</string>
     <string name="su_snack_log_off">Os registros de %1$s foram desativados</string>
-    <string name="su_revoke_title">Remover?</string>
-    <string name="su_revoke_msg">Confirmar a remoção do acesso de %1$s?</string>
+    <string name="su_revoke_title">Revogar?</string>
+    <string name="su_revoke_msg">Confirmar a remoção do acesso de SuperUsuário de %1$s?</string>
     <string name="toast">Notificação (Pop-up)</string>
     <string name="none">Nenhum</string>
     <string name="superuser_toggle_notification">Notificações</string>
-    <string name="superuser_toggle_revoke">Remover</string>
-    <string name="superuser_policy_none">Nenhum app solicitou permissão de SuperUsuário ainda.</string>
+    <string name="superuser_toggle_revoke">Revogar</string>
+    <string name="superuser_policy_none">Nenhum app solicitou permissão de SuperUsuário ainda</string>
 
     <!--Logs-->
-    <string name="log_data_none">Não há registros. Tente usar os apps permitidos para SuperUsuário.</string>
-    <string name="log_data_magisk_none">Os Registro de atividade do Magisk estão vazios, isso é estranho.</string>
-    <string name="menuSaveLog">Salvar Registro</string>
-    <string name="menuClearLog">Limpar Registro agora</string>
-    <string name="logs_cleared">Registro limpo com sucesso.</string>
+    <string name="log_data_none">Não há registros. Tente usar mais seus apps root.</string>
+    <string name="log_data_magisk_none">Os registros do Magisk estão vazios, isso é estranho.</string>
+    <string name="menuSaveLog">Salvar registros</string>
+    <string name="menuClearLog">Limpar registros agora</string>
+    <string name="logs_cleared">Registros limpo com sucesso</string>
     <string name="pid">PID: %1$d</string>
     <string name="target_uid">Alvo UID: %1$d</string>
     <string name="target_pid">Alvo PID: %s</string>
@@ -91,10 +91,10 @@
     <string name="supp_group">Grupo suplementar: %s</string>
 
     <!--MagiskHide-->
-    <string name="show_system_app">Mostrar apps do Sistema</string>
-    <string name="show_os_app">Mostrar apps do Sistema</string>
+    <string name="show_system_app">Mostrar apps do sistema</string>
+    <string name="show_os_app">Mostrar apps do sistema operacional</string>
     <string name="hide_filter_hint">Filtrar pelo nome</string>
-    <string name="hide_search">Pesquisa</string>
+    <string name="hide_search">Pesquisar</string>
 
     <!--Module-->
     <string name="no_info_provided">(Nenhuma informação fornecida)</string>
@@ -108,48 +108,48 @@
     <string name="module_state_restore">Restaurar</string>
     <string name="module_action_install_external">Instalar a partir do armazenamento</string>
     <string name="update_available">Atualização disponível</string>
-    <string name="suspend_text_riru">Módulo suspenso porque %1$s está ativo</string>
-    <string name="suspend_text_zygisk">Módulo suspenso porque %1$s não está ativo</string>
+    <string name="suspend_text_riru">Módulo suspenso porque %1$s está ativado</string>
+    <string name="suspend_text_zygisk">Módulo suspenso porque %1$s não está ativado</string>
     <string name="zygisk_module_unloaded">Modulo Zygisk não carregado devido a incompatibilidade</string>
     <string name="module_empty">Nenhum módulo instalado</string>
     <string name="confirm_install">Instalar módulo %1$s?</string>
-    <string name="confirm_install_title">Confirmação de Instalação</string>
+    <string name="confirm_install_title">Confirmação de instalação</string>
 
     <!--Settings-->
-    <string name="settings_dark_mode_title">Modo de tema</string>
+    <string name="settings_dark_mode_title">Modo do tema</string>
     <string name="settings_dark_mode_message">Selecione o modo mais adequado ao seu estilo!</string>
-    <string name="settings_dark_mode_light">Sempre Claro</string>
-    <string name="settings_dark_mode_system">Baseado no Sistema</string>
-    <string name="settings_dark_mode_dark">Sempre Escuro</string>
-    <string name="settings_download_path_title">Caminho para Baixar</string>
+    <string name="settings_dark_mode_light">Sempre claro</string>
+    <string name="settings_dark_mode_system">Mesmo do sistema</string>
+    <string name="settings_dark_mode_dark">Sempre escuro</string>
+    <string name="settings_download_path_title">Caminho para baixar</string>
     <string name="settings_download_path_message">Os arquivos serão salvos em %1$s</string>
     <string name="settings_hide_app_title">Ocultar o app do Magisk</string>
     <string name="settings_hide_app_summary">Instala o app oculto com ID aleatório e nome personalizado</string>
-    <string name="settings_restore_app_title">Restaurar o App do Magisk</string>
+    <string name="settings_restore_app_title">Restaurar o app do Magisk</string>
     <string name="settings_restore_app_summary">Desoculta o app do Magisk e restaura o APK original</string>
     <string name="language">Idioma</string>
     <string name="system_default">(Padrão do sistema)</string>
-    <string name="settings_check_update_title">Ativar Verificação de Atualizações</string>
-    <string name="settings_check_update_summary">Verifica periodicamente em segundo plano se há atualizações</string>
-    <string name="settings_update_channel_title">Canal de Atualização</string>
+    <string name="settings_check_update_title">Verificar atualizações</string>
+    <string name="settings_check_update_summary">Verifica periodicamente se há atualizações em segundo plano</string>
+    <string name="settings_update_channel_title">Canal de atualização</string>
     <string name="settings_update_stable">Estável</string>
     <string name="settings_update_beta">Beta</string>
-    <string name="settings_update_custom">Canal Personalizado</string>
-    <string name="settings_update_custom_msg">Insira um URL personalizado</string>
+    <string name="settings_update_custom">Personalizado</string>
+    <string name="settings_update_custom_msg">Insira um URL de canal personalizado</string>
     <string name="settings_zygisk_summary">Executa partes do Magisk no Zygote</string>
-    <string name="settings_denylist_title">Forçar Aplicação da Lista de Negação</string>
-    <string name="settings_denylist_summary">Os processos na lista de negação terão revertidas todas as modificações feitas pelo Magisk</string>
+    <string name="settings_denylist_title">Aplicar Lista de negação</string>
+    <string name="settings_denylist_summary">Os processos na Lista de negação terão todas as modificações do Magisk revertidas</string>
     <string name="settings_denylist_error">Isso requer %1$s para ser ativado</string>
-    <string name="settings_denylist_config_title">Configurar Lista de Negação</string>
-    <string name="settings_denylist_config_summary">Selecione os processos a serem incluídos na lista de negação</string>
-    <string name="settings_hosts_title">Ativar /etc/hosts systemless</string>
-    <string name="settings_hosts_summary">Suporte de /etc/hosts fora do sistema para aplicativos Adblock</string>
-    <string name="settings_hosts_toast">Adicionado módulo do /etc/hosts systemless</string>
+    <string name="settings_denylist_config_title">Configurar Lista de negação</string>
+    <string name="settings_denylist_config_summary">Selecione os processos a serem incluídos na Lista de negação</string>
+    <string name="settings_hosts_title">Hosts fora do sistema</string>
+    <string name="settings_hosts_summary">Suporte de /etc/hosts fora do sistema para apps Adblock</string>
+    <string name="settings_hosts_toast">Adicionado módulo de /etc/hosts fora do sistema</string>
     <string name="settings_app_name_hint">Novo nome</string>
     <string name="settings_app_name_helper">O app do Magisk será reinstalado com este nome</string>
     <string name="settings_app_name_error">Formato inválido</string>
-    <string name="settings_su_app_adb">Aplicativos e ADB</string>
-    <string name="settings_su_app">Apenas aplicativos</string>
+    <string name="settings_su_app_adb">Apps e ADB</string>
+    <string name="settings_su_app">Apenas apps</string>
     <string name="settings_su_adb">Apenas ADB</string>
     <string name="settings_su_disable">Desativado</string>
     <string name="settings_su_request_10">10 segundos</string>
@@ -160,33 +160,33 @@
     <string name="settings_su_request_60">60 segundos</string>
     <string name="superuser_access">Acesso de SuperUsuário</string>
     <string name="auto_response">Resposta automática</string>
-    <string name="request_timeout">Tempo Limite da Solicitação</string>
+    <string name="request_timeout">Tempo limite da solicitação</string>
     <string name="superuser_notification">Notificação de SuperUsuário</string>
-    <string name="settings_su_reauth_title">Autenticar novamente após a atualização</string>
-    <string name="settings_su_reauth_summary">Reautenticar permissões de SuperUsuário após atualizar aplicativo</string>
-    <string name="settings_su_tapjack_title">Ativar Proteção Contra Atividades Sobrepostas</string>
-    <string name="settings_su_tapjack_summary">A caixa de diálogo do SuperUsuário não responderá à entrada enquanto estiver obscurecida por qualquer outra janela ou sobreposição</string>
-    <string name="settings_su_biometric_title">Ativar Autenticação Biométrica</string>
-    <string name="settings_su_biometric_summary">Use a autenticação biométrica para permitir solicitações de SuperUsuário</string>
-    <string name="no_biometric">Dispositivo não suportado ou nenhuma configuração biométrica está ativada</string>
+    <string name="settings_su_reauth_title">Reautenticar após atualização</string>
+    <string name="settings_su_reauth_summary">Reautenticar permissões de SuperUsuário após atualizar os apps</string>
+    <string name="settings_su_tapjack_title">Proteção contra atividades sobrepostas</string>
+    <string name="settings_su_tapjack_summary">A caixa de diálogo do SuperUsuário não responderá à entrada enquanto estiver oculta por qualquer outra janela ou sobreposição</string>
+    <string name="settings_su_auth_title">Autenticação de usuário</string>
+    <string name="settings_su_auth_summary">Solicite autenticação de usuário durante solicitações de SuperUsuário</string>
+    <string name="settings_su_auth_insecure">Nenhum método de autenticação está configurado no dispositivo</string>
     <string name="settings_customization">Personalizações</string>
-    <string name="setting_add_shortcut_summary">Adicione um atalho na tela inicial, caso o nome e o ícone sejam difíceis de reconhecer logo após ocultar o aplicativo</string>
-    <string name="settings_doh_title">Ativar DNS sobre HTTPS</string>
+    <string name="setting_add_shortcut_summary">Adicione um atalho na tela inicial, caso o nome e o ícone sejam difíceis de reconhecer logo após ocultar o app.</string>
+    <string name="settings_doh_title">DNS sobre HTTPS</string>
     <string name="settings_doh_description">Solução alternativa para envenenamento de DNS em alguns países</string>
-    <string name="multiuser_mode">Ativar Modo Multiusuário</string>
+    <string name="multiuser_mode">Modo Multiusuário</string>
     <string name="settings_owner_only">Somente proprietário do dispositivo</string>
     <string name="settings_owner_manage">Gerenciado pelo proprietário do dispositivo</string>
     <string name="settings_user_independent">Independente do usuário</string>
-    <string name="owner_only_summary">Somente o proprietário tem acesso ao SuperUsuário</string>
-    <string name="owner_manage_summary">Somente o proprietário pode gerenciar o acesso do SuperUsuário e receber pedidos de solicitação</string>
+    <string name="owner_only_summary">Somente o proprietário tem acesso root</string>
+    <string name="owner_manage_summary">Somente o proprietário pode gerenciar o acesso root e receber pedidos de solicitação</string>
     <string name="user_independent_summary">Cada usuário tem suas próprias regras de root separadas</string>
-    <string name="mount_namespace_mode">Ativar Modo Namespace</string>
+    <string name="mount_namespace_mode">Montar modo Namespace</string>
     <string name="settings_ns_global">Namespace global</string>
     <string name="settings_ns_requester">Herdar Namespace</string>
     <string name="settings_ns_isolate">Namespace isolado</string>
     <string name="global_summary">Todas as sessões root usam o namespace de montagem global</string>
     <string name="requester_summary">As sessões root herdarão o namespace do solicitante</string>
-    <string name="isolate_summary">Cada sessão do SuperUsuário terá seu próprio namespace isolado</string>
+    <string name="isolate_summary">Cada sessão root terá seu próprio namespace isolado</string>
 
     <!--Notifications-->
     <string name="update_channel">Atualizações do Magisk</string>
@@ -194,8 +194,8 @@
     <string name="updated_channel">Atualização concluída</string>
     <string name="download_complete">Download concluído</string>
     <string name="download_file_error">Erro ao baixar arquivo</string>
-    <string name="magisk_update_title">Nova atualização do Magisk disponível!</string>
-    <string name="updated_title">Magisk Atualizado</string>
+    <string name="magisk_update_title">Atualização do Magisk disponível!</string>
+    <string name="updated_title">Magisk atualizado</string>
     <string name="updated_text">Toque para abrir o app</string>
 
     <!--Toasts, Dialogs-->
@@ -205,35 +205,35 @@
     <string name="download">Baixar</string>
     <string name="reboot">Reiniciar</string>
     <string name="release_notes">Notas da atualização</string>
-    <string name="flashing">Fazendo Flash…</string>
+    <string name="flashing">Flashando…</string>
     <string name="done">Concluído!</string>
-    <string name="failure">Falha</string>
+    <string name="failure">Falha!</string>
     <string name="hide_app_title">Ocultando o app do Magisk…</string>
     <string name="open_link_failed_toast">Nenhum app encontrado para abrir o link</string>
     <string name="complete_uninstall">Desinstalação completa</string>
     <string name="restore_img">Restaurar imagens</string>
     <string name="restore_img_msg">Restaurando…</string>
     <string name="restore_done">Restauração concluída!</string>
-    <string name="restore_fail">O backup original não foi encontrado!</string>
+    <string name="restore_fail">O backup original não existe!</string>
     <string name="setup_fail">Falha na instalação</string>
     <string name="env_fix_title">Configuração adicional exigida</string>
     <string name="env_fix_msg">Seu dispositivo exige uma configuração adicional para o Magisk funcionar corretamente. Deseja continuar e reiniciar?</string>
-    <string name="env_full_fix_msg">Seu dispositivo precisa refazer o flash do Magisk para funcionar corretamente. Reinstale o Magisk no aplicativo, o modo de recuperação não pode obter as devidas informações do dispositivo.</string>
+    <string name="env_full_fix_msg">Seu dispositivo precisa refazer o flash do Magisk para funcionar corretamente. Por favor, reinstale o Magisk no app, o modo Recovery não pode obter as devidas informações do dispositivo.</string>
     <string name="setup_msg">Executando a configuração do ambiente…</string>
     <string name="authenticate">Autenticar</string>
     <string name="unsupport_magisk_title">Versão do Magisk não suportada</string>
-    <string name="unsupport_magisk_msg">Essa versão do app não suporta versão do Magisk inferior a %1$s.\n\nO app irá se comportar como se nenhum Magisk estivesse sido instalado. Por favor, atualize o Magisk assim que possível.</string>
-    <string name="unsupport_general_title">Estado Anormal</string>
-    <string name="unsupport_system_app_msg">Não há suporte para executar este app como um app do sistema. Por favor, reverta o app para um app do usuário.</string>
+    <string name="unsupport_magisk_msg">Esta versão do app não suporta a versão do Magisk inferior a %1$s.\n\nO app irá se comportar como se nenhum Magisk estivesse sido instalado. Por favor, atualize o Magisk assim que possível.</string>
+    <string name="unsupport_general_title">Estado anormal</string>
+    <string name="unsupport_system_app_msg">Não há suporte para executar este app como um app do sistema. Por favor, reverta o app para um app de usuário.</string>
     <string name="unsupport_other_su_msg">Não foi possível detectar o binário \"su\" do Magisk. Por favor, remova qualquer outro root concorrente e/ou reinstale o Magisk.</string>
-    <string name="unsupport_external_storage_msg">O app do Magisk está instalado no armazenamento externo, Por favor, mova o app para o armazenamento interno.</string>
-    <string name="unsupport_nonroot_stub_msg">O app oculto do Magisk não pode continuar a funcionar porque o SuperUsuário foi perdido. Por favor, restaure o APK original.</string>
+    <string name="unsupport_external_storage_msg">O app do Magisk está instalado no armazenamento externo. Por favor, mova o app para o armazenamento interno.</string>
+    <string name="unsupport_nonroot_stub_msg">O app oculto do Magisk não pode continuar funcionando porque o root foi perdido. Por favor, restaure o APK original.</string>
     <string name="unsupport_nonroot_stub_title">@string/settings_restore_app_title</string>
-    <string name="external_rw_permission_denied">Autorize a permissão de armazenamento para ativar esta funcionalidade</string>
-    <string name="post_notifications_denied">Autorize a permissão de notificaçoes para ativar esta funcionalidade</string>
-    <string name="install_unknown_denied">Permita a "instalação apps desconhecidos" para ativar esta funcionalidade</string>
-    <string name="add_shortcut_title">Adicionar Atalho à Tela Inicial</string>
-    <string name="add_shortcut_msg">Depois de ocultar o app do Magisk, o seu nome e ícone ficarão difíceis de reconhecer. Deseja adicionar um atalho na tela inicial?</string>
+    <string name="external_rw_permission_denied">Conceda permissão de armazenamento para ativar esta funcionalidade</string>
+    <string name="post_notifications_denied">Conceda permissão às notificações para ativar esta funcionalidade</string>
+    <string name="install_unknown_denied">Permita a opção "Instalar apps de fontes desconhecidas" para ativar esta funcionalidade</string>
+    <string name="add_shortcut_title">Adicionar atalho à tela inicial</string>
+    <string name="add_shortcut_msg">Após ocultar o app do Magisk, seu nome e ícone ficarão difíceis de reconhecer. Deseja adicionar um atalho na tela inicial?</string>
     <string name="app_not_found">Nenhum app encontrado para realizar esta ação</string>
     <string name="reboot_apply_change">Reinicie para aplicar as mudanças</string>
     <string name="restore_app_confirmation">Isso irá restaurar o app oculto do Magisk de volta para o app original. Deseja realmente fazer isso?</string>

app/src/main/res/values-ro/strings.xml

@@ -167,9 +167,6 @@
     <string name="settings_su_reauth_summary">Cere din nou permisiunile de superutilizator după actualizarea aplicațiilor</string>
     <string name="settings_su_tapjack_title">Protecție față de tapjacking</string>
     <string name="settings_su_tapjack_summary">Caseta de dialog pentru solicitarea permisiunilor de superutilizator nu va răspunde la input cât timp este ascunsă de orice altă fereastră sau suprapunere</string>
-    <string name="settings_su_biometric_title">Autentificare biometrică</string>
-    <string name="settings_su_biometric_summary">Folosește autentificarea biometrică pentru a permite cereri de superutilizator</string>
-    <string name="no_biometric">Dispozitiv nesuportat sau nu sunt activate setări biometrice</string>
     <string name="settings_customization">Personalizare</string>
     <string name="setting_add_shortcut_summary">Adaugă o comandă rapidă frumoasă în ecranul de pornire în cazul în care numele și pictograma sunt dificil de recunoscut după ascunderea aplicației</string>
     <string name="settings_doh_title">DNS prin HTTPS</string>

app/src/main/res/values-ru/strings.xml

@@ -167,9 +167,6 @@
     <string name="settings_su_reauth_summary">Повторный запрос прав суперпользователя после обновления приложений</string>
     <string name="settings_su_tapjack_title">Защита от перехвата нажатий</string>
     <string name="settings_su_tapjack_summary">Окно запроса прав суперпользователя будет неактивно пока активированы наложения экрана</string>
-    <string name="settings_su_biometric_title">Биометрическая аутентификация</string>
-    <string name="settings_su_biometric_summary">Принимать запросы прав суперпользователя только после биометрической аутентификации</string>
-    <string name="no_biometric">Функция не поддерживается устройством или не заданы настройки блокировки экрана</string>
     <string name="settings_customization">Персонализация</string>
     <string name="setting_add_shortcut_summary">Добавить ярлык на рабочий стол для удобного восприятия приложения после его скрытия</string>
     <string name="settings_doh_title">DNS поверх HTTPS</string>

app/src/main/res/values-sk/strings.xml

@@ -170,9 +170,9 @@
     <string name="settings_su_reauth_summary">Opätovne vyzve na udelenie oprávnení Superužívateľa po upgrade aplikácie</string>
     <string name="settings_su_tapjack_title">Ochrana pred tapjackingom</string>
     <string name="settings_su_tapjack_summary">Dialógové okno superužívateľa nebude reagovať na zadanie, ak je zakryté alebo prekryté iným oknom</string>
-    <string name="settings_su_biometric_title">Biometrické overenie</string>
-    <string name="settings_su_biometric_summary">Použije biometrickú autentifikáciu na povolenie žiadostí superužívateľa</string>
-    <string name="no_biometric">Nepodporované zariadenie alebo žiadne biometrické nastavenia nie sú povolené</string>
+    <string name="settings_su_auth_title">Overenie používateľa</string>
+    <string name="settings_su_auth_summary">Žiadosť o overenie používateľa počas požiadaviek Superužívateľa</string>
+    <string name="settings_su_auth_insecure">V zariadení nie je nakonfigurovaná žiadna metóda overovania</string>
     <string name="settings_customization">Prispôsobenie</string>
     <string name="setting_add_shortcut_summary">V prípade, že sa po skrytí apky názov a ikona ťažko rozpoznávajú, pridať na domovskú obrazovku odkaz</string>
     <string name="settings_doh_title">DNS over HTTPS</string>

app/src/main/res/values-sq/strings.xml

@@ -170,9 +170,6 @@
     <string name="settings_su_reauth_summary">Ri-vërtetoni lejet e super-përdoruesit pas azhurnimit të aplikacionit</string>
     <string name="settings_su_tapjack_title">Aktivizo mbrojtjen tapjacking</string>
     <string name="settings_su_tapjack_summary">Dialogu i menjëhershëm i super-përdoruesit nuk do ti përgjigjet hyrjes ndërsa është i errësuar nga ndonjë dritare ose mbivendosje tjetër</string>
-    <string name="settings_su_biometric_title">Aktivizo vërtetimin biometrik</string>
-    <string name="settings_su_biometric_summary">Përdorni vërtetimin biometrik për të lejuar kërkesat e super-përdoruesit</string>
-    <string name="no_biometric">Pajisja e pambështetur ose cilësimet biometrike nuk janë të aktivizuara</string>
     <string name="settings_customization">Personalizimi</string>
     <string name="setting_add_shortcut_summary">Shtoni një shkurtore mjaft të mirë në ekranin fillestar në rast se emri dhe ikona janë të vështira për tu njohur pasi keni fshehur aplikacionin</string>
     <string name="settings_doh_title">DNS mbi HTTPS</string>
@@ -191,7 +188,10 @@
     <string name="global_summary">Të gjitha sesionet rrënjë përdorin hapësirën globale të emrave të montimit</string>
     <string name="requester_summary">Seancat rrënjësore do të trashëgojnë hapësirën e emrave të kërkuesit të tyre</string>
     <string name="isolate_summary">Çdo sesion rrënjë do të ketë hapësirën e vet të izoluar të emrave</string>
-
+    <string name="settings_su_auth_title">Vërtetimi i përdoruesit</string>
+    <string name="settings_su_auth_summary">Kërkoni vërtetimin e përdoruesit gjatë kërkesave të Superpërdoruesit</string>
+    <string name="settings_su_auth_insecure">Asnjë metodë vërtetimi nuk është konfiguruar në pajisje</string>
+    
     <!--Notifications-->
     <string name="update_channel">Përditësimet e magisk</string>
     <string name="updated_channel">Përditësimi përfundoi</string>

app/src/main/res/values-sv/strings.xml

@@ -151,9 +151,6 @@
     <string name="settings_su_reauth_summary">Återautentisera superuser-rättigheter efter en applikationsuppdatering</string>
     <string name="settings_su_tapjack_title">Aktivera Tapjacking-skydd</string>
     <string name="settings_su_tapjack_summary">Superuser-dialogrutan kommer inte att lyssna på någon input om den är dold eller övertäckt utav något annat fönster.</string>
-    <string name="settings_su_biometric_title">Aktivera biometriskt autentisering</string>
-    <string name="settings_su_biometric_summary">Använd biometriskt autentisering för att tillåta förfrågan om superuser-tillgång</string>
-    <string name="no_biometric">Denna enhet stöds ej eller så är inte biometrisk autentisering aktiverad</string>
     <string name="settings_customization">Anpassning</string>
     <string name="setting_add_shortcut_summary">Lägg till en snygg genväg på startskärmen om namnet och ikonen är svåra att känna igen efter att appen har döljts</string>
     <string name="settings_doh_title">DNS över HTTPS</string>

app/src/main/res/values-sw/strings.xml

@@ -163,9 +163,6 @@
     <string name="settings_su_reauth_summary">Ask for Superuser permissions again after upgrading apps</string>
     <string name="settings_su_tapjack_title">Tapjacking Protection</string>
     <string name="settings_su_tapjack_summary">The Superuser prompt dialog will not respond to input while obscured by any other window or overlay</string>
-    <string name="settings_su_biometric_title">Biometric Authentication</string>
-    <string name="settings_su_biometric_summary">Use biometric authentication to allow Superuser requests</string>
-    <string name="no_biometric">Unsupported device or no biometric settings are enabled</string>
     <string name="settings_customization">Customization</string>
     <string name="setting_add_shortcut_summary">Add a pretty shortcut to the home screen in case the name and icon are difficult to recognize after hiding the app</string>
     <string name="settings_doh_title">DNS over HTTPS</string>

app/src/main/res/values-ta/strings.xml

@@ -152,9 +152,6 @@
     <string name="settings_su_reauth_summary">பயன்பாட்டு மேம்படுத்தல்களுக்குப் பிறகு சூப்பர் யூசர் அனுமதிகளை மீண்டும் அங்கீகரிக்கவும்</string>
     <string name="settings_su_tapjack_title">டாப்ஜாகிங் பாதுகாப்பை இயக்கு</string>
     <string name="settings_su_tapjack_summary">வேறு எந்த சாளரத்தாலும் அல்லது மேலடுக்கினாலும் மறைக்கப்படும்போது சூப்பர் யூசர் வரியில் உரையாடல் உள்ளீட்டிற்கு பதிலளிக்காது</string>
-    <string name="settings_su_biometric_title">பயோமெட்ரிக் அங்கீகாரத்தை இயக்கு</string>
-    <string name="settings_su_biometric_summary">சூப்பர் யூசர் கோரிக்கைகளை அனுமதிக்க பயோமெட்ரிக் அங்கீகாரத்தைப் பயன்படுத்தவும்</string>
-    <string name="no_biometric">ஆதரிக்கப்படாத சாதனம் அல்லது பயோமெட்ரிக் அமைப்புகள் எதுவும் செயல்படுத்தப்படவில்லை</string>
     <string name="settings_customization">தனிப்பயனாக்கம்</string>
     <string name="setting_add_shortcut_summary">பயன்பாட்டை மறைத்தபின் பெயர் மற்றும் ஐகான் அடையாளம் காண கடினமாக இருந்தால் முகப்புத் திரையில் அழகான குறுக்குவழியைச் சேர்க்கவும்</string>
     <string name="settings_doh_title">HTTPS வழியாக டி.என்.எஸ்</string>

app/src/main/res/values-tr/strings.xml

@@ -34,7 +34,7 @@
     <!--Install-->
     <string name="keep_force_encryption">Zorla şifrelemeyi koru</string>
     <string name="keep_dm_verity">AVB 2.0/dm-verity\'yi koruyun</string>
-    <string name="patch_vbmeta">Önyükleme görüntüsünde vbmeta yaması</string>
+    <string name="patch_vbmeta">Önyükleme görüntüsünde vbmeta yamasını uygula</string>
     <string name="recovery_mode">Kurtarma Modu</string>
     <string name="install_options_title">Seçenekler</string>
     <string name="install_method_title">Yöntem</string>
@@ -55,24 +55,24 @@
     <string name="touch_filtered_warning">Bir uygulama bir Süper Kullanıcı isteğini engellediği için Magisk yanıtınızı doğrulayamıyor</string>
     <string name="deny">Reddet</string>
     <string name="prompt">Hemen</string>
-    <string name="grant">İzin</string>
-    <string name="su_warning">Cihazınıza tam erişim sağlar.\nEmin değilseniz reddedin!</string>
+    <string name="grant">İzin ver</string>
+    <string name="su_warning">Cihazınıza tam erişim sağlar.\nEğer emin değilseniz reddedin!</string>
     <string name="forever">Daima</string>
     <string name="once">Bir kere</string>
     <string name="tenmin">10 dakika</string>
     <string name="twentymin">20 dakika</string>
     <string name="thirtymin">30 dakika</string>
     <string name="sixtymin">60 dakika</string>
-    <string name="su_allow_toast">%1$s Süper Kullanıcı hakları verildi</string>
-    <string name="su_deny_toast">%1$s Süper Kullanıcı hakları reddedildi</string>
-    <string name="su_snack_grant">%1$s Süper Kullanıcı hakları verildi</string>
-    <string name="su_snack_deny">%1$s Süper Kullanıcı hakları reddedildi</string>
-    <string name="su_snack_notif_on">%1$s bildirimleri etkinleştirildi</string>
-    <string name="su_snack_notif_off">%1$s bildirimleri devre dışı bırakıldı</string>
-    <string name="su_snack_log_on">%1$s günlüğü etkinleştirildi</string>
-    <string name="su_snack_log_off">%1$s günlüğü devre dışı bırakıldı</string>
+    <string name="su_allow_toast">%1$s uygulamasının Süper Kullanıcı izni verildi</string>
+    <string name="su_deny_toast">%1$s uygulamasının Süper Kullanıcı izni reddedildi</string>
+    <string name="su_snack_grant">%1$s uygulamasının Süper Kullanıcı izni verildi</string>
+    <string name="su_snack_deny">%1$s uygulamasının Süper Kullanıcı izni reddedildi</string>
+    <string name="su_snack_notif_on">%1$s uygulamasının bildirimleri etkinleştirildi</string>
+    <string name="su_snack_notif_off">%1$s uygulamasının bildirimleri devre dışı bırakıldı</string>
+    <string name="su_snack_log_on">%1$s uygulamasının günlüğü etkinleştirildi</string>
+    <string name="su_snack_log_off">%1$s uygulamasının günlüğü devre dışı bırakıldı</string>
     <string name="su_revoke_title">İptal et?</string>
-    <string name="su_revoke_msg">%1$s Süper Kullanıcı haklarını iptal etmeyi onaylayın</string>
+    <string name="su_revoke_msg">%1$s uygulamasının Süper Kullanıcı haklarını iptal etmeyi onaylayın</string>
     <string name="toast">Tost</string>
     <string name="none">Hiçbiri</string>
 
@@ -99,11 +99,11 @@
 
     <!--Module-->
     <string name="no_info_provided">(Bilgi verilmedi)</string>
-    <string name="reboot_userspace">Yumuşak yeniden başlatma</string>
-    <string name="reboot_recovery">Kurtarma için Yeniden Başlatın</string>
-    <string name="reboot_bootloader">Bootloader için Yeniden Başlatın</string>
-    <string name="reboot_download">İndirmek için Yeniden Başlatın</string>
-    <string name="reboot_edl">EDL için Yeniden Başlatın</string>
+    <string name="reboot_userspace">Yazılımsal olarak yeniden başlat</string>
+    <string name="reboot_recovery">Kurtarma modunda Yeniden Başlat</string>
+    <string name="reboot_bootloader">Önyükleyici modunda Yeniden Başlat</string>
+    <string name="reboot_download">Download modu için Yeniden Başlat</string>
+    <string name="reboot_edl">EDL modunda Yeniden Başlat</string>
     <string name="module_version_author">%1$s / %2$s</string>
     <string name="module_state_remove">Kaldır</string>
     <string name="module_state_restore">Geri yükle</string>
@@ -119,9 +119,9 @@
     <!--Settings-->
     <string name="settings_dark_mode_title">Tema Modu</string>
     <string name="settings_dark_mode_message">Tarzınıza en uygun modu seçin!</string>
-    <string name="settings_dark_mode_light">Daima Açık</string>
+    <string name="settings_dark_mode_light">Her zaman Açık</string>
     <string name="settings_dark_mode_system">Sistemi Takip Et</string>
-    <string name="settings_dark_mode_dark">Daima Koyu</string>
+    <string name="settings_dark_mode_dark">Her zaman Koyu</string>
     <string name="settings_download_path_title">İndirme yolu</string>
     <string name="settings_download_path_message">Dosyalar %1$s konumuna kaydedilecek</string>
     <string name="settings_hide_app_title">Magisk uygulamasını gizleyin</string>
@@ -131,7 +131,7 @@
     <string name="language">Dil</string>
     <string name="system_default">(Sistem Varsayılanı)</string>
     <string name="settings_check_update_title">Güncellemeleri Kontrol Et</string>
-    <string name="settings_check_update_summary">Arka planda güncellemeleri periyodik olarak kontrol edin</string>
+    <string name="settings_check_update_summary">Arka planda güncellemeleri düzenli olarak kontrol edin</string>
     <string name="settings_update_channel_title">Güncelleme Kanalı</string>
     <string name="settings_update_stable">Stabil</string>
     <string name="settings_update_beta">Beta</string>
@@ -165,11 +165,8 @@
     <string name="superuser_notification">Süper Kullanıcı Bildirimi</string>
     <string name="settings_su_reauth_title">Yükseltmeden sonra yeniden kimlik doğrulaması yapın</string>
     <string name="settings_su_reauth_summary">Uygulamaları yükselttikten sonra Süper Kullanıcı izinlerini tekrar isteyin</string>
-    <string name="settings_su_tapjack_title">Sahte Ekran Koruması</string>
+    <string name="settings_su_tapjack_title">Sahte Ekran (Tapjacking) Koruması</string>
     <string name="settings_su_tapjack_summary">Süper Kullanıcı bilgi istemi iletişim kutusu, herhangi bir başka pencere veya yer paylaşımı tarafından engellendiğinde girişe yanıt vermeyecektir.</string>
-    <string name="settings_su_biometric_title">Biyometrik Kimlik Doğrulama</string>
-    <string name="settings_su_biometric_summary">Süper Kullanıcı isteklerine izin vermek için biyometrik kimlik doğrulamayı kullanın</string>
-    <string name="no_biometric">Desteklenmeyen cihaz veya hiçbir biyometrik ayar etkin değil</string>
     <string name="settings_customization">Özelleştir</string>
     <string name="setting_add_shortcut_summary">Uygulamayı gizledikten sonra adın ve simgenin tanınmasının zor olması durumunda ana ekrana güzel bir kısayol ekleyin</string>
     <string name="settings_doh_title">HTTPS üzerinden DNS</string>
@@ -219,7 +216,7 @@
     <string name="restore_done">Geri yükleme tamamlandı!</string>
     <string name="restore_fail">Stok yedeği mevcut değil!</string>
     <string name="setup_fail">Kurulum başarısız oldu</string>
-    <string name="env_fix_title">Ek Kurulum Gerektirir</string>
+    <string name="env_fix_title">Ek Kurulum Gerekiyor</string>
     <string name="env_fix_msg">Magisk\'in düzgün çalışması için cihazınızın ek kuruluma ihtiyacı var. Devam etmek ve yeniden başlatmak istiyor musunuz?</string>
     <string name="env_full_fix_msg">Cihazınızın düzgün çalışması için Magisk\'in yeniden yüklenmeye ihtiyacı var. Lütfen Magisk\'i uygulama içinde yeniden yükleyin, kurtarma modu doğru cihaz bilgilerini alamıyor.</string>
     <string name="setup_msg">Ortam kurulumu çalıştırılıyor…</string>
@@ -227,18 +224,18 @@
     <string name="unsupport_magisk_title">Desteklenmeyen Magisk Sürümü</string>
     <string name="unsupport_magisk_msg">Uygulamanın bu sürümü, %1$s\'den daha düşük Magisk sürümlerini desteklemiyor.\n\nUygulama, Magisk kurulu değilmiş gibi davranacak, lütfen Magisk\'i mümkün olan en kısa sürede yükseltin.</string>
     <string name="unsupport_general_title">Anormal Durum</string>
-    <string name="unsupport_system_app_msg">Bu uygulamayı bir sistem uygulaması olarak çalıştırmak desteklenmiyor. Lütfen uygulamayı bir kullanıcı uygulamasına geri döndürün.</string>
-    <string name="unsupport_other_su_msg">Magisk\'ten olmayan bir \"su\" ikili dosyası algılandı. Lütfen rakip kök çözümlerini kaldırın ve/veya Magisk\'i yeniden yükleyin.</string>
+    <string name="unsupport_system_app_msg">Bu uygulamayı bir sistem uygulaması olarak çalıştırma desteklenmiyor. Lütfen uygulamayı bir kullanıcı uygulamasına geri döndürün.</string>
+    <string name="unsupport_other_su_msg">Magisk\'ten olmayan bir \"su\" ikili dosyası algılandı. Lütfen başka kök çözümlerini kaldırın ve/veya Magisk\'i yeniden yükleyin.</string>
     <string name="unsupport_external_storage_msg">Magisk, harici depolama birimine kurulur. Lütfen uygulamayı dahili depolamaya taşıyın.</string>
     <string name="unsupport_nonroot_stub_msg">Kök kaybolduğu için gizli Magisk uygulaması çalışmaya devam edemiyor. Lütfen orijinal APK\'yı geri yükleyin.</string>
     <string name="unsupport_nonroot_stub_title">@string/settings_restore_app_title</string>
-    <string name="external_rw_permission_denied">Bu işlevi etkinleştirmek için depolama izni verin</string>
-    <string name="post_notifications_denied">Bu işlevi etkinleştirmek için bildirim izni verin</string>
-    <string name="install_unknown_denied">Bu işlevi etkinleştirmek için "bilinmeyen uygulamaları yükle"ye izin verin</string>
+    <string name="external_rw_permission_denied">Bu işlevi etkinleştirmek için depolama izni veriniz.</string>
+    <string name="post_notifications_denied">Bu işlevi etkinleştirmek için bildirim izni veriniz.</string>
+    <string name="install_unknown_denied">Bu işlevi etkinleştirmek için "Bilinmeyen uygulamaları yükle" ayarına izin veriniz.</string>
     <string name="add_shortcut_title">Ana ekrana kısayol ekle</string>
     <string name="add_shortcut_msg">Bu uygulamayı gizledikten sonra adını ve simgesini tanımak zorlaşabilir. Ana ekrana hoş bir kısayol eklemek ister misiniz?</string>
     <string name="app_not_found">Bu eylemi gerçekleştirecek uygulama bulunamadı</string>
     <string name="reboot_apply_change">Değişiklikleri uygulamak için yeniden başlatın</string>
-    <string name="restore_app_confirmation">Bu, gizli uygulamayı orijinal uygulamaya geri yükleyecektir. Gerçekten bunu yapmak istiyor musun?</string>
+    <string name="restore_app_confirmation">Bu işlem, gizli uygulamayı orijinal uygulama ile değiştirecektir. Bu işlemi yapmak istediğinizden emin misiniz?</string>
 
 </resources>

app/src/main/res/values-uk/strings.xml

@@ -159,9 +159,6 @@
     <string name="settings_su_reauth_summary">Перевидача прав суперкористувача після оновлення застосунку</string>
     <string name="settings_su_tapjack_title">Увімкнути захист від Tapjack</string>
     <string name="settings_su_tapjack_summary">Діалогове вікно суперкористувача не буде отримувати ввід від користувача, коли вікно перекрито іншим застосунком чи вікном</string>
-    <string name="settings_su_biometric_title">Біометрична автентифікація</string>
-    <string name="settings_su_biometric_summary">Використовувати біометричну автентифікацію, щоб підтверджувати запити суперкористувача</string>
-    <string name="no_biometric">Пристрій не підтримується, або не налаштовано біометрику</string>
     <string name="settings_customization">Оформлення</string>
     <string name="setting_add_shortcut_summary">Додати ярлик на домашній екран для зручного сприйняття застосунку після його приховування</string>
     <string name="settings_doh_title">DNS поверх HTTPS</string>

app/src/main/res/values-vi/strings.xml

@@ -165,9 +165,6 @@
     <string name="settings_su_reauth_summary">Xác thực lại quyền Superuser sau khi nâng cấp ứng dụng</string>
     <string name="settings_su_tapjack_title">Bảo vệ khỏi Tapjacking</string>
     <string name="settings_su_tapjack_summary">Hộp thoại nhắc Superuser sẽ không trả lời đầu vào khi bị che khuất bởi bất kỳ cửa sổ hoặc lớp phủ nào khác</string>
-    <string name="settings_su_biometric_title">Bật xác thực sinh trắc học</string>
-    <string name="settings_su_biometric_summary">Sử dụng xác thực sinh trắc học để xác nhận yêu cầu Superuser</string>
-    <string name="no_biometric">Thiết bị của bạn không được hỗ trợ hoặc không có phương pháp xác thực sinh trắc học nào được kích hoạt</string>
     <string name="settings_customization">Tùy biến</string>
     <string name="setting_add_shortcut_summary">Thêm một phím tắt đẹp vào màn hình trong trường hợp khó tìm ra tên và biểu tượng sau khi ẩn ứng dụng</string>
     <string name="settings_doh_title">DNS over HTTPS</string>

app/src/main/res/values-zh-rCN/strings.xml

@@ -170,9 +170,9 @@
     <string name="settings_su_reauth_summary">应用更新后重新认证超级用户权限</string>
     <string name="settings_su_tapjack_title">点按劫持保护</string>
     <string name="settings_su_tapjack_summary">存在屏幕叠加层时，超级用户请求弹窗不响应允许操作</string>
-    <string name="settings_su_biometric_title">生物识别验证</string>
-    <string name="settings_su_biometric_summary">使用生物识别来允许超级用户请求</string>
-    <string name="no_biometric">设备不支持或未配置生物识别功能</string>
+    <string name="settings_su_auth_title">身份验证</string>
+    <string name="settings_su_auth_summary">对超级用户请求验证身份</string>
+    <string name="settings_su_auth_insecure">设备未配置验证方式</string>
     <string name="settings_customization">个性化</string>
     <string name="setting_add_shortcut_summary">在隐藏后难以识别名称和图标的情况下，添加快捷方式到桌面</string>
     <string name="settings_doh_title">安全 DNS（DoH）</string>

app/src/main/res/values-zh-rTW/strings.xml

@@ -167,9 +167,6 @@
     <string name="settings_su_reauth_summary">應用程式更新後，重新驗證超級使用者的要求</string>
     <string name="settings_su_tapjack_title">啟用點選攔截保護</string>
     <string name="settings_su_tapjack_summary">發現有其他應用程式重疊在超級使用者視窗上面時，不回應允許操作</string>
-    <string name="settings_su_biometric_title">生物特徵辨識驗證</string>
-    <string name="settings_su_biometric_summary">使用生物特徵辨識驗證來允許超級使用者的要求</string>
-    <string name="no_biometric">不支援的裝置或是未啟用生物特徵辨識設定</string>
     <string name="settings_customization">客製化</string>
     <string name="setting_add_shortcut_summary">在主螢幕中新增一個精緻的捷徑。防止隱藏 Magisk 以後，其名稱與圖示將難以辨識</string>
     <string name="settings_doh_title">安全化的網域解析(DoH)</string>

app/src/main/res/values/strings.xml

@@ -170,9 +170,9 @@
     <string name="settings_su_reauth_summary">Ask for Superuser permissions again after upgrading apps</string>
     <string name="settings_su_tapjack_title">Tapjacking Protection</string>
     <string name="settings_su_tapjack_summary">The Superuser prompt dialog will not respond to input while obscured by any other window or overlay</string>
-    <string name="settings_su_biometric_title">Biometric Authentication</string>
-    <string name="settings_su_biometric_summary">Use biometric authentication to allow Superuser requests</string>
-    <string name="no_biometric">Unsupported device or no biometric settings are enabled</string>
+    <string name="settings_su_auth_title">User Authentication</string>
+    <string name="settings_su_auth_summary">Ask for user authentication during Superuser requests</string>
+    <string name="settings_su_auth_insecure">No authentication method is configured on the device</string>
     <string name="settings_customization">Customization</string>
     <string name="setting_add_shortcut_summary">Add a pretty shortcut to the home screen in case the name and icon are difficult to recognize after hiding the app</string>
     <string name="settings_doh_title">DNS over HTTPS</string>

build.gradle.kts

@@ -3,5 +3,5 @@ plugins {
 }
 
 tasks.register("clean", Delete::class) {
-    delete(rootProject.buildDir)
+    delete(rootProject.layout.buildDirectory)
 }

build.py

@@ -62,6 +62,8 @@ if shutil.which("sccache") is not None:
     os.environ["RUSTC_WRAPPER"] = "sccache"
     os.environ["NDK_CCACHE"] = "sccache"
     os.environ["CARGO_INCREMENTAL"] = "0"
+if shutil.which("ccache") is not None:
+    os.environ["NDK_CCACHE"] = "ccache"
 
 cpu_count = multiprocessing.cpu_count()
 os_name = platform.system().lower()
@@ -187,15 +189,17 @@ def load_config(args):
 
     # Default values
     config["version"] = commit_hash
+    config["versionCode"] = 1000000
     config["outdir"] = "out"
 
     # Load prop files
     if op.exists(args.config):
         config.update(parse_props(args.config))
 
-    for key, value in parse_props("gradle.properties").items():
-        if key.startswith("magisk."):
-            config[key[7:]] = value
+    if op.exists("gradle.properties"):
+        for key, value in parse_props("gradle.properties").items():
+            if key.startswith("magisk."):
+                config[key[7:]] = value
 
     try:
         config["versionCode"] = int(config["versionCode"])
@@ -242,7 +246,7 @@ def run_ndk_build(flags):
         error("Build binary failed!")
     os.chdir("..")
     for arch in archs:
-        for tgt in support_targets + ["libinit-ld.so", "libzygisk-ld.so"]:
+        for tgt in support_targets + ["libinit-ld.so"]:
             source = op.join("native", "libs", arch, tgt)
             target = op.join("native", "out", arch, tgt)
             mv(source, target)
@@ -252,7 +256,7 @@ def run_cargo(cmds, triple="aarch64-linux-android"):
     env = os.environ.copy()
     env["PATH"] = f'{rust_bin}{os.pathsep}{env["PATH"]}'
     env["CARGO_BUILD_RUSTC"] = op.join(rust_bin, "rustc" + EXE_EXT)
-    env["RUSTFLAGS"] = "-Clinker-plugin-lto"
+    env["RUSTFLAGS"] = f"-Clinker-plugin-lto -Zthreads={min(8, cpu_count)}"
     env["TARGET_CC"] = op.join(llvm_bin, "clang" + EXE_EXT)
     env["TARGET_CFLAGS"] = f"--target={triple}23"
     return execv([cargo, *cmds], env)
@@ -270,10 +274,7 @@ def run_cargo_build(args):
         return
 
     # Start building the actual build commands
-    cmds = ["build"]
-    for target in targets:
-        cmds.append("-p")
-        cmds.append(target)
+    cmds = ["build", "-p", ""]
     rust_out = "debug"
     if args.release:
         cmds.append("-r")
@@ -289,9 +290,12 @@ def run_cargo_build(args):
             "thumbv7neon-linux-androideabi" if triple.startswith("armv7") else triple
         )
         cmds[-1] = rust_triple
-        proc = run_cargo(cmds, triple)
-        if proc.returncode != 0:
-            error("Build binary failed!")
+
+        for target in targets:
+            cmds[2] = target
+            proc = run_cargo(cmds, triple)
+            if proc.returncode != 0:
+                error("Build binary failed!")
 
         arch_out = op.join(native_out, arch)
         mkdir(arch_out)
@@ -338,9 +342,6 @@ def dump_bin_header(args):
         preload = op.join("native", "out", arch, "libinit-ld.so")
         with open(preload, "rb") as src:
             text = binary_dump(src, "init_ld_xz")
-        preload = op.join("native", "out", arch, "libzygisk-ld.so")
-        with open(preload, "rb") as src:
-            text += binary_dump(src, "zygisk_ld", compressor=lambda x: x)
         write_if_diff(op.join(native_gen_path, f"{arch}_binaries.h"), text)
 
 
@@ -391,8 +392,9 @@ def build_binary(args):
     flag = ""
     clean = False
 
-    if "magisk" in args.target or "magiskinit" in args.target:
-        flag += " B_PRELOAD=1"
+    if "magisk" in args.target:
+        flag += " B_MAGISK=1"
+        clean = True
 
     if "magiskpolicy" in args.target:
         flag += " B_POLICY=1"
@@ -413,14 +415,10 @@ def build_binary(args):
     if flag:
         run_ndk_build(flag)
 
-    # magiskinit and magisk embeds preload.so
+    # magiskinit embeds preload.so
 
     flag = ""
 
-    if "magisk" in args.target:
-        flag += " B_MAGISK=1"
-        clean = True
-
     if "magiskinit" in args.target:
         flag += " B_INIT=1"
 

buildSrc/build.gradle.kts

@@ -16,9 +16,9 @@ gradlePlugin {
 }
 
 dependencies {
-    implementation(kotlin("gradle-plugin", "1.9.0"))
-    implementation("com.android.tools.build:gradle:8.1.1")
-    implementation("androidx.navigation:navigation-safe-args-gradle-plugin:2.7.1")
+    implementation(embeddedKotlin("gradle-plugin"))
+    implementation("com.android.tools.build:gradle:8.2.1")
+    implementation("androidx.navigation:navigation-safe-args-gradle-plugin:2.7.6")
     implementation("org.lsposed.lsparanoid:gradle-plugin:0.5.2")
-    implementation("org.eclipse.jgit:org.eclipse.jgit:6.5.0.202303070854-r")
+    implementation("org.eclipse.jgit:org.eclipse.jgit:6.7.0.202309050840-r")
 }

buildSrc/src/main/java/Setup.kt

@@ -72,6 +72,7 @@ fun Project.setupCommon() {
         compileSdkVersion(34)
         buildToolsVersion = "34.0.0"
         ndkPath = "$sdkDirectory/ndk/magisk"
+        ndkVersion = "26.1.10909125"
 
         defaultConfig {
             minSdk = 23
@@ -213,7 +214,7 @@ private fun Project.setupAppCommon() {
             this.comment.set("version=${Config.version}\n" +
                 "versionCode=${Config.versionCode}\n" +
                 "stubVersion=${Config.stubVersion}\n")
-            this.outFolder.set(File(buildDir, "outputs/apk/${variant.name}"))
+            this.outFolder.set(layout.buildDirectory.dir("outputs/apk/${variant.name}"))
         }
     }
 }
@@ -318,8 +319,8 @@ fun Project.setupStub() {
             project.tasks.register("${variantName}ManifestProducer", ManifestUpdater::class.java) {
                 dependsOn("generate${variantCapped}ObfuscatedClass")
                 applicationId.set(variant.applicationId)
-                appClassDir.set(File(buildDir, "generated/source/app/$variantName"))
-                factoryClassDir.set(File(buildDir, "generated/source/factory/$variantName"))
+                appClassDir.set(layout.buildDirectory.dir("generated/source/app/$variantName"))
+                factoryClassDir.set(layout.buildDirectory.dir("generated/source/factory/$variantName"))
             }
         variant.artifacts.use(manifestUpdater)
             .wiredWithFiles(
@@ -331,12 +332,12 @@ fun Project.setupStub() {
     android.applicationVariants.all {
         val variantCapped = name.replaceFirstChar { it.uppercase() }
         val variantLowered = name.lowercase()
-        val outFactoryClassDir = File(buildDir, "generated/source/factory/${variantLowered}")
-        val outAppClassDir = File(buildDir, "generated/source/app/${variantLowered}")
-        val outResDir = File(buildDir, "generated/source/res/${variantLowered}")
+        val outFactoryClassDir = layout.buildDirectory.file("generated/source/factory/${variantLowered}").get().asFile
+        val outAppClassDir = layout.buildDirectory.file("generated/source/app/${variantLowered}").get().asFile
+        val outResDir = layout.buildDirectory.dir("generated/source/res/${variantLowered}").get().asFile
         val aapt = File(android.sdkDirectory, "build-tools/${android.buildToolsVersion}/aapt2")
-        val apk = File(buildDir, "intermediates/processed_res/" +
-            "${variantLowered}/out/resources-${variantLowered}.ap_")
+        val apk = layout.buildDirectory.file("intermediates/processed_res/" +
+            "${variantLowered}/out/resources-${variantLowered}.ap_").get().asFile
 
         val genManifestTask = tasks.register("generate${variantCapped}ObfuscatedClass") {
             inputs.property("seed", RAND_SEED)
@@ -377,10 +378,10 @@ fun Project.setupStub() {
         registerJavaGeneratingTask(processResourcesTask, outResDir)
     }
     // Override optimizeReleaseResources task
-    val apk = File(buildDir, "intermediates/processed_res/" +
-        "release/out/resources-release.ap_")
-    val optRes = File(buildDir, "intermediates/optimized_processed_res/" +
-        "release/resources-release-optimize.ap_")
+    val apk = layout.buildDirectory.file("intermediates/processed_res/" +
+        "release/out/resources-release.ap_").get().asFile
+    val optRes = layout.buildDirectory.file("intermediates/optimized_processed_res/" +
+        "release/resources-release-optimize.ap_").get().asFile
     afterEvaluate {
         tasks.named("optimizeReleaseResources") {
             doLast { apk.copyTo(optRes, true) }

docs/build.md

@@ -10,7 +10,7 @@
 - Windows only: Enable [developer mode](https://learn.microsoft.com/en-us/windows/apps/get-started/enable-your-device-for-development). This is required because we need symbolic link support.
 - Install Python 3.8+:
   - On Unix, install python3 using your favorite package manager
-  - On Windows, download and install the latest Python version on the [offical website](https://www.python.org/downloads/windows/).<br>
+  - On Windows, download and install the latest Python version on the [official website](https://www.python.org/downloads/windows/).<br>
     Make sure to select **"Add Python to PATH"** during installation.
   - (Optional on Windows): Run `pip install colorama` to install the `colorama` python package
 - Install Git:
@@ -40,7 +40,7 @@
 
 ### Developing Rust in Android Studio
 
-Because the Magisk NDK package, [ONDK](https://github.com/topjohnwu/ondk) (the one installed with `./build.py ndk`), contains a fully self contained Clang + Rust toolchain, building the Magisk project alone does not require configuring toolchains. However, due to the way how the Intellij Rust plugin works, you'll have to go through some additional setup to make Android Studio work with Magisk's Rust codebase:
+Because the Magisk NDK package, [ONDK](https://github.com/topjohnwu/ondk) (the one installed with `./build.py ndk`), contains a fully self contained Clang + Rust toolchain, building the Magisk project alone does not require configuring toolchains. However, due to the way the IntelliJ Rust plugin works, you'll have to go through some additional setup to make Android Studio work with Magisk's Rust codebase:
 
 - Install [rustup](https://rustup.rs/), the official Rust toolchain manager
 - Link the ONDK Rust toolchain and set it as default:

docs/changes.md

@@ -1,5 +1,24 @@
 # Magisk Changelog
 
+### v27.0
+
+- [Zygisk] Introduce new code injection mechanism
+- [Zygisk] Support new signature introduced in U QPR2
+- [SEPolicy] Update libsepol to properly set some policy config bits
+- [MagiskBoot] Support compressing `init` so Magisk is installable on devices with small boot partitions
+- [ResetProp] Add new wait for property feature `resetprop -w`
+
+### v26.4
+
+- [MagiskBoot] Don't pad zeros if signed boot image is larger
+- [MagiskPolicy] Fix `genfscon` and `filename_trans`
+- [MagiskPolicy] Fix bug in `libsepol`
+- [Zygisk] Fix and simplify file descriptor sanitization logic
+- [App] Prevent OOM when patching AP tarfiles
+- [App] Fix bug in device configuration detection
+- [Daemon] Fix certificate parsing of APKs
+- [General] Fix logging errors from C++ code being ignored
+
 ### v26.3
 
 - [General] Fix device information detection script

docs/details.md

@@ -110,4 +110,4 @@ Before Android 8.0, all allowed su client domains are allowed to directly connec
 
 After Android 8.0, to reduce relaxation of rules in Android's sandbox, a new SELinux model is deployed. The `magisk` binary is labelled with `magisk_exec` file type, and processes running as allowed su client domains executing the `magisk` binary (this includes the `su` command) will transit to `magisk_client` by using a `type_transition` rule. Rules strictly restrict that only `magisk` domain processes are allowed to attribute files to `magisk_exec`. Direct connection to sockets of `magiskd` are not allowed; the only way to access the daemon is through a `magisk_client` process. These changes allow us to keep the sandbox intact, and keep Magisk specific rules separated from the rest of the policies.
 
-The full set of rules can be found in `magiskpolicy/rules.cpp`.
+The full set of rules can be found in `sepolicy/rules.cpp`.

docs/guides.md

@@ -109,7 +109,7 @@ Update JSON format:
 
 #### Shell scripts (`*.sh`)
 
-Please read the [Boot Scripts](#boot-scripts) section to understand the difference between `post-fs-data.sh` and `service.sh`. For most module developers, `service.sh` should be good enough if you just need to run a boot script.
+Please read the [Boot Scripts](#boot-scripts) section to understand the difference between `post-fs-data.sh` and `service.sh`. For most module developers, `service.sh` should be good enough if you just need to run a boot script. If you need to wait for boot completed, you can use `resetprop -w sys.boot_completed 0`.
 
 In all scripts of your module, please use `MODDIR=${0%/*}` to get your module's base directory path; do **NOT** hardcode your module path in scripts.
 If Zygisk is enabled, the environment variable `ZYGISK_ENABLED` will be set to `1`.
@@ -265,7 +265,7 @@ Overlay files shall be placed in the `overlay.d` folder in boot image ramdisk, a
 
 To add additional files which you can refer to in your custom `*.rc` scripts, add them into `overlay.d/sbin`. The 3 rules above do not apply to anything in this folder; instead, they will be directly copied to Magisk's internal `tmpfs` directory (which used to always be `/sbin`).
 
-Starting from Android 11, the `/sbin` folder may no longer exists, and in that scenario, Magisk randomly generates a different `tmpfs` folder each boot. Every occurrence of the pattern `${MAGISKTMP}` in your `*.rc` scripts will be replaced with the Magisk `tmpfs` folder when `magiskinit` injects it into `init.rc`. On pre Android 11 devices, `${MAGISKTMP}` will simply be replaced with `/sbin`, so **NEVER** hardcode `/sbin` in the `*.rc` scripts when referencing these additional files.
+Starting from Android 11, the `/sbin` folder may no longer exists, and in that scenario, Magisk uses `/debug_ramdisk` instead. Every occurrence of the pattern `${MAGISKTMP}` in your `*.rc` scripts will be replaced with the Magisk `tmpfs` folder when `magiskinit` injects it into `init.rc`. On pre Android 11 devices, `${MAGISKTMP}` will simply be replaced with `/sbin`, so **NEVER** hardcode `/sbin` in the `*.rc` scripts when referencing these additional files.
 
 Here is an example of how to setup `overlay.d` with a custom `*.rc` script:
 

docs/install.md

@@ -26,19 +26,10 @@ If your device has boot ramdisk, get a copy of the `boot.img` (or `init_boot.img
 If your device does **NOT** have boot ramdisk, get a copy of the `recovery.img`.<br>
 You should be able to extract the file you need from official firmware packages or your custom ROM zip.
 
-Next, we need to know whether your device has a separate `vbmeta` partition.
-
-- If your official firmware package contains `vbmeta.img`, then yes, your device **has** a separate `vbmeta` partition
-- You can also check by connecting your device to a PC and run the command:<br>
-  `adb shell ls -l /dev/block/by-name`
-- If you find `vbmeta`, `vbmeta_a`, or `vbmeta_b`, then yes, your device **has** a separate `vbmeta` partition
-- Otherwise, your device **does not** have a separate `vbmeta` partition.
-
 Quick recap, at this point, you should have known and prepared:
 
 1. Whether your device has boot ramdisk
-2. Whether your device has a separate `vbmeta` partition
-3. A `boot.img`, `init_boot.img` or `recovery.img` based on (1)
+2. A `boot.img`, `init_boot.img` or `recovery.img` based on (1)
 
 Let's continue to [Patching Images](#patching-images).
 
@@ -47,21 +38,21 @@ Let's continue to [Patching Images](#patching-images).
 - Copy the boot/init_boot/recovery image to your device
 - Press the **Install** button in the Magisk card
 - If you are patching a recovery image, check the **"Recovery Mode"** option
-- If your device does **NOT** have a separate `vbmeta` partition, check the **"Patch vbmeta in boot image"** option
 - Choose **"Select and Patch a File"** in method, and select the boot/init_boot/recovery image
 - Start the installation, and copy the patched image to your PC using ADB:<br>
   `adb pull /sdcard/Download/magisk_patched_[random_strings].img`
 - Flash the patched boot/init_boot/recovery image to your device;<br>
   for most devices, reboot into fastboot mode and flash with command:<br>
-  `fastboot flash boot[_x] /path/to/magisk_patched_[random_strings].img` or <br>
-  `fastboot flash init_boot[_x] /path/to/magisk_patched.img_[random_strings]` or <br>
+  `fastboot flash boot /path/to/magisk_patched_[random_strings].img` or <br>
+  `fastboot flash init_boot /path/to/magisk_patched.img_[random_strings]` or <br>
   `fastboot flash recovery /path/to/magisk_patched.img_[random_strings]`, <br>
-  where `[_x]` should be `_a` or `_b` or empty depending on your device
 - (Optional) If your device has a separate `vbmeta` partition, you can patch the `vbmeta` partition with command:<br>
   `fastboot flash vbmeta --disable-verity --disable-verification vbmeta.img` (note that it may **wipe your data**)
 - Reboot and launch Magisk app (you will see a stub Magisk app if you have wiped your data; use it to bootstrap to a complete Magisk app), and you will see a prompt asking for environment fix; click and wait for the reboot
 - Voila!
 
+> Warning: **NEVER** flash patched image shared by others or patch image on another device even if they have the same device model! You may need to do a full data wipe to recover your device. **ALWAYS** patch boot image **on the same device where you want to install Magisk**.
+
 ## Uninstallation
 
 The easiest way to uninstall Magisk is directly through the Magisk app. If you insist on using custom recoveries, rename the Magisk APK to `uninstall.zip` and flash it like any other ordinary flashable zip.
@@ -107,7 +98,7 @@ To unlock your bootloader, follow the instructions below. If no OEM Lock value i
 Possible KnoxGuard values are the following:
 
 - `Active`, `Locked`: your device has been remotely locked by your telecom operator or your insurance company.
-- `Prenormal`: your device is temporarely locked, reaching 168h of uptime should trigger unlock.
+- `Prenormal`: your device is temporarily locked, reaching 168h of uptime should trigger unlock.
 - `Checking`, `Completed`, `Broken`: your device is unlocked.
 
 Having KnoxGuard active will prevent you from installing/running Magisk regardless of your bootloader lock state.

docs/releases/26400.md

@@ -0,0 +1,12 @@
+## 2023.11.5 Magisk v26.4
+
+- [MagiskBoot] Don't pad zeros if signed boot image is larger
+- [MagiskPolicy] Fix `genfscon` and `filename_trans`
+- [MagiskPolicy] Fix bug in `libsepol`
+- [Zygisk] Fix and simplify file descriptor sanitization logic
+- [App] Prevent OOM when patching AP tarfiles
+- [App] Fix bug in device configuration detection
+- [Daemon] Fix certificate parsing of APKs
+- [General] Fix logging errors from C++ code being ignored
+
+### Full Changelog: [here](https://topjohnwu.github.io/Magisk/changes.html)

docs/releases/27000.md

@@ -0,0 +1,9 @@
+## 2024.2.3 Magisk v27.0
+
+- [Zygisk] Introduce new code injection mechanism
+- [Zygisk] Support new signature introduced in U QPR2
+- [SEPolicy] Update libsepol to properly set some policy config bits
+- [MagiskBoot] Support compressing `init` so Magisk is installable on devices with small boot partitions
+- [ResetProp] Add new wait for property feature `resetprop -w`
+
+### Full Changelog: [here](https://topjohnwu.github.io/Magisk/changes.html)

docs/releases/index.md

@@ -1,5 +1,7 @@
 # Release Notes
 
+- [v27.0](27000.md)
+- [v26.4](26400.md)
 - [v26.3](26300.md)
 - [v26.2](26200.md)
 - [v26.1](26100.md)

docs/tools.md

@@ -16,7 +16,7 @@ su -> magisk
 
 A tool to unpack / repack boot images, parse / patch / extract cpio, patch dtb, hex patch binaries, and compress / decompress files with multiple algorithms.
 
-`magiskboot` natively supports (which means it does not rely on external tools) common compression formats including `gzip`, `lz4`, `lz4_legacy` ([only used on LG](https://events.static.linuxfound.org/sites/events/files/lcjpcojp13_klee.pdf)), `lzma`, `xz`, and `bzip2`.
+`magiskboot` natively supports (which means it does not rely on external tools) common compression formats including `gzip`, `lz4`, `lz4_legacy` , `lz4_lg` ([the LG edition](https://events.static.linuxfound.org/sites/events/files/lcjpcojp13_klee.pdf) of `lz4_legacy`, only used on LG), `lzma`, `xz`, and `bzip2`.
 
 The concept of `magiskboot` is to make boot image modification simpler. For unpacking, it parses the header and extracts all sections in the image, decompressing on-the-fly if compression is detected in any sections. For repacking, the original boot image is required so the original headers can be used, changing only the necessary entries such as section sizes and checksum. All sections will be compressed back to the original format if required. The tool also supports many CPIO and DTB operations.
 
@@ -51,6 +51,28 @@ Supported actions:
     If env variable PATCHVBMETAFLAG is set to true, all disable flags in
     the boot image's vbmeta header will be set.
 
+  verify <bootimg> [x509.pem]
+    Check whether the boot image is signed with AVB 1.0 signature.
+    Optionally provide a certificate to verify whether the image is
+    signed by the public key certificate.
+    Return value:
+    0:valid    1:error
+
+  sign <bootimg> [name] [x509.pem pk8]
+    Sign <bootimg> with AVB 1.0 signature.
+    Optionally provide the name of the image (default: '/boot').
+    Optionally provide the certificate/private key pair for signing.
+    If the certificate/private key pair is not provided, the AOSP
+    verity key bundled in the executable will be used.
+
+  extract <payload.bin> [partition] [outfile]
+    Extract [partition] from <payload.bin> to [outfile].
+    If [outfile] is not specified, then output to '[partition].img'.
+    If [partition] is not specified, then attempt to extract either
+    'init_boot' or 'boot'. Which partition was chosen can be determined
+    by whichever 'init_boot.img' or 'boot.img' exists.
+    <payload.bin> can be '-' to be STDIN.
+
   hexpatch <file> <hexpattern1> <hexpattern2>
     Search <hexpattern1> in <file>, and replace it with <hexpattern2>
 
@@ -83,8 +105,6 @@ Supported actions:
         Create ramdisk backups from ORIG
       restore
         Restore ramdisk from ramdisk backup stored within incpio
-      sha1
-        Print stock boot SHA1 if previously backed up in ramdisk
 
   dtb <file> <action> [args...]
     Do dtb related actions to <file>
@@ -222,7 +242,7 @@ Options:
    -v                        print running daemon version
    -V                        print running daemon version code
    --list                    list all available applets
-   --remove-modules          remove all modules and reboot
+   --remove-modules [-n]     remove all modules, reboot if -n is not provided
    --install-module ZIP      install a module zip file
 
 Advanced Options (Internal APIs):
@@ -237,6 +257,7 @@ Advanced Options (Internal APIs):
    --sqlite SQL              exec SQL commands to Magisk database
    --path                    print Magisk tmpfs mount path
    --denylist ARGS           denylist config CLI
+   --preinit-device          resolve a device to store preinit files
 
 Available applets:
     su, resetprop
@@ -261,20 +282,24 @@ An applet of `magisk`, the MagiskSU entry point. Good old `su` command.
 Usage: su [options] [-] [user [argument...]]
 
 Options:
-  -c, --command COMMAND         pass COMMAND to the invoked shell
-  -h, --help                    display this help message and exit
-  -, -l, --login                pretend the shell to be a login shell
+  -c, --command COMMAND         Pass COMMAND to the invoked shell
+  -g, --group GROUP             Specify the primary group
+  -G, --supp-group GROUP        Specify a supplementary group.
+                                The first specified supplementary group is also used
+                                as a primary group if the option -g is not specified.
+  -Z, --context CONTEXT         Change SELinux context
+  -t, --target PID              PID to take mount namespace from
+  -h, --help                    Display this help message and exit
+  -, -l, --login                Pretend the shell to be a login shell
   -m, -p,
-  --preserve-environment        preserve the entire environment
-  -s, --shell SHELL             use SHELL instead of the default /system/bin/sh
-  -v, --version                 display version number and exit
-  -V                            display version code and exit
+  --preserve-environment        Preserve the entire environment
+  -s, --shell SHELL             Use SHELL instead of the default /system/bin/sh
+  -v, --version                 Display version number and exit
+  -V                            Display version code and exit
   -mm, -M,
-  --mount-master                force run in the global mount namespace
+  --mount-master                Force run in the global mount namespace
 ```
 
-Note: even though the `-Z, --context` option is not listed above, the option still exists for CLI compatibility with apps designed for SuperSU. However the option is silently ignored since it's no longer relevant.
-
 ### resetprop
 
 An applet of `magisk`. An advanced system property manipulation utility. Check the [Resetprop Details](details.md#resetprop) for more background information.

gradle.properties

@@ -26,6 +26,6 @@ android.injected.testOnly=false
 android.nonFinalResIds=false
 
 # Magisk
-magisk.stubVersion=37
-magisk.versionCode=26300
-magisk.ondkVersion=r26.0
+magisk.stubVersion=38
+magisk.versionCode=27000
+magisk.ondkVersion=r26.3

gradle/wrapper/gradle-wrapper.properties

@@ -1,6 +1,7 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.3-rc-2-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.6-bin.zip
 networkTimeout=10000
+validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists

gradlew

@@ -83,7 +83,8 @@ done
 # This is normally unused
 # shellcheck disable=SC2034
 APP_BASE_NAME=${0##*/}
-APP_HOME=$( cd "${APP_HOME:-./}" && pwd -P ) || exit
+# Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036)
+APP_HOME=$( cd "${APP_HOME:-./}" > /dev/null && pwd -P ) || exit
 
 # Use the maximum available, or set MAX_FD != -1 to use that value.
 MAX_FD=maximum
@@ -130,10 +131,13 @@ location of your Java installation."
     fi
 else
     JAVACMD=java
-    which java >/dev/null 2>&1 || die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
+    if ! command -v java >/dev/null 2>&1
+    then
+        die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
 
 Please set the JAVA_HOME variable in your environment to match the
 location of your Java installation."
+    fi
 fi
 
 # Increase the maximum file descriptors if we can.
@@ -141,7 +145,7 @@ if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
     case $MAX_FD in #(
       max*)
         # In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked.
-        # shellcheck disable=SC3045
+        # shellcheck disable=SC2039,SC3045
         MAX_FD=$( ulimit -H -n ) ||
             warn "Could not query maximum file descriptor limit"
     esac
@@ -149,7 +153,7 @@ if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
       '' | soft) :;; #(
       *)
         # In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked.
-        # shellcheck disable=SC3045
+        # shellcheck disable=SC2039,SC3045
         ulimit -n "$MAX_FD" ||
             warn "Could not set maximum file descriptor limit to $MAX_FD"
     esac
@@ -198,11 +202,11 @@ fi
 # Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
 DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
 
-# Collect all arguments for the java command;
-#   * $DEFAULT_JVM_OPTS, $JAVA_OPTS, and $GRADLE_OPTS can contain fragments of
-#     shell script including quotes and variable substitutions, so put them in
-#     double quotes to make sure that they get re-expanded; and
-#   * put everything else in single quotes, so that it's not re-expanded.
+# Collect all arguments for the java command:
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, JAVA_OPTS, and optsEnvironmentVar are not allowed to contain shell fragments,
+#     and any embedded shellness will be escaped.
+#   * For example: A user cannot expect ${Hostname} to be expanded, as it is an environment variable and will be
+#     treated as '${Hostname}' itself on the command line.
 
 set -- \
         "-Dorg.gradle.appname=$APP_BASE_NAME" \

gradlew.bat

@@ -43,11 +43,11 @@ set JAVA_EXE=java.exe
 %JAVA_EXE% -version >NUL 2>&1
 if %ERRORLEVEL% equ 0 goto execute
 
-echo.
-echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
-echo.
-echo Please set the JAVA_HOME variable in your environment to match the
-echo location of your Java installation.
+echo. 1>&2
+echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. 1>&2
+echo. 1>&2
+echo Please set the JAVA_HOME variable in your environment to match the 1>&2
+echo location of your Java installation. 1>&2
 
 goto fail
 
@@ -57,11 +57,11 @@ set JAVA_EXE=%JAVA_HOME%/bin/java.exe
 
 if exist "%JAVA_EXE%" goto execute
 
-echo.
-echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME%
-echo.
-echo Please set the JAVA_HOME variable in your environment to match the
-echo location of your Java installation.
+echo. 1>&2
+echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% 1>&2
+echo. 1>&2
+echo Please set the JAVA_HOME variable in your environment to match the 1>&2
+echo location of your Java installation. 1>&2
 
 goto fail
 

native/src/.cargo/config.toml

@@ -7,19 +7,3 @@ target = "aarch64-linux-android"
 build-std = ["std", "panic_abort"]
 build-std-features = ["panic_immediate_abort"]
 profile-rustflags = true
-
-# Workaround bug for undefined symbol errors that occur with the
-# combination of `-Zbuild-std`, `opt-level = "z"`, and `lto = true`.
-# compiler_builtins are expected to be built with special flags.
-# https://github.com/rust-lang/rust/issues/108853
-# https://github.com/rust-lang/wg-cargo-std-aware/issues/62
-
-[profile.release.package.compiler_builtins]
-rustflags = ["-Zshare-generics=off"]
-overflow-checks = false
-debug-assertions = false
-
-[profile.dev.package.compiler_builtins]
-rustflags = ["-Zshare-generics=off"]
-overflow-checks = false
-debug-assertions = false

native/src/Android-rs.mk

@@ -8,6 +8,7 @@ LIBRARY_PATH = ../out/$(TARGET_ARCH_ABI)/libmagisk-rs.a
 ifneq (,$(wildcard $(LOCAL_PATH)/$(LIBRARY_PATH)))
 include $(CLEAR_VARS)
 LOCAL_MODULE := magisk-rs
+LOCAL_EXPORT_C_INCLUDES := src/core/include
 LOCAL_SRC_FILES := $(LIBRARY_PATH)
 include $(PREBUILT_STATIC_LIBRARY)
 endif

native/src/Android.mk

@@ -10,9 +10,7 @@ include $(CLEAR_VARS)
 LOCAL_MODULE := magisk
 LOCAL_STATIC_LIBRARIES := \
     libbase \
-    libnanopb \
     libsystemproperties \
-    libphmap \
     liblsplt \
     libmagisk-rs
 
@@ -25,24 +23,22 @@ LOCAL_SRC_FILES := \
     core/db.cpp \
     core/package.cpp \
     core/scripting.cpp \
-    core/restorecon.cpp \
+    core/selinux.cpp \
     core/module.cpp \
     core/thread.cpp \
-    core/resetprop/persist.cpp \
-    core/resetprop/resetprop.cpp \
     core/core-rs.cpp \
+    core/resetprop/resetprop.cpp \
     core/su/su.cpp \
     core/su/connect.cpp \
     core/su/pts.cpp \
     core/su/su_daemon.cpp \
-    zygisk/entry.cpp \
-    zygisk/main.cpp \
-    zygisk/utils.cpp \
-    zygisk/hook.cpp \
-    zygisk/memory.cpp \
-    zygisk/deny/cli.cpp \
-    zygisk/deny/utils.cpp \
-    zygisk/deny/revert.cpp
+    core/zygisk/entry.cpp \
+    core/zygisk/main.cpp \
+    core/zygisk/module.cpp \
+    core/zygisk/hook.cpp \
+    core/deny/cli.cpp \
+    core/deny/utils.cpp \
+    core/deny/revert.cpp
 
 LOCAL_LDLIBS := -llog
 LOCAL_LDFLAGS := -Wl,--dynamic-list=src/exported_sym.txt
@@ -59,12 +55,6 @@ LOCAL_SRC_FILES := init/preload.c
 LOCAL_STRIP_MODE := --strip-all
 include $(BUILD_SHARED_LIBRARY)
 
-include $(CLEAR_VARS)
-LOCAL_MODULE := zygisk-ld
-LOCAL_SRC_FILES := zygisk/loader.c
-LOCAL_STRIP_MODE := --strip-all
-include $(BUILD_SHARED_LIBRARY)
-
 endif
 
 ifdef B_INIT
@@ -101,7 +91,6 @@ LOCAL_STATIC_LIBRARIES := \
     liblzma \
     liblz4 \
     libbz2 \
-    libfdt \
     libz \
     libzopfli \
     libboot-rs
@@ -111,7 +100,6 @@ LOCAL_SRC_FILES := \
     boot/bootimg.cpp \
     boot/compress.cpp \
     boot/format.cpp \
-    boot/dtb.cpp \
     boot/boot-rs.cpp
 
 include $(BUILD_EXECUTABLE)
@@ -139,14 +127,13 @@ include $(CLEAR_VARS)
 LOCAL_MODULE := resetprop
 LOCAL_STATIC_LIBRARIES := \
     libbase \
-    libnanopb \
     libsystemproperties \
     libmagisk-rs
 
 LOCAL_SRC_FILES := \
     core/applet_stub.cpp \
     core/resetprop/resetprop.cpp \
-    core/resetprop/persist.cpp
+    core/core-rs.cpp
 
 LOCAL_CFLAGS := -DAPPLET_STUB_MAIN=resetprop_main
 include $(BUILD_EXECUTABLE)

native/src/Cargo.lock

@@ -4,9 +4,9 @@ version = 3
 
 [[package]]
 name = "aho-corasick"
-version = "1.0.4"
+version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6748e8def348ed4d14996fa801f4122cd763fff530258cdc03f64b25f89d3a5a"
+checksum = "b2969dcb958b36655471fc61f7e416fa76033bdd4bfed0678d8fee1e2d07a1f0"
 dependencies = [
  "memchr",
 ]
@@ -23,7 +23,7 @@ dependencies = [
 [[package]]
 name = "argh"
 version = "0.1.12"
-source = "git+https://github.com/topjohnwu/argh.git?rev=f0ca7d9d7f66b4ff56fbbd44ce19a96c625bffd8#f0ca7d9d7f66b4ff56fbbd44ce19a96c625bffd8"
+source = "git+https://github.com/google/argh.git?rev=1c632b046d084e7bde86b82dfc969b30b4647c8c#1c632b046d084e7bde86b82dfc969b30b4647c8c"
 dependencies = [
  "argh_derive",
  "argh_shared",
@@ -32,18 +32,18 @@ dependencies = [
 [[package]]
 name = "argh_derive"
 version = "0.1.12"
-source = "git+https://github.com/topjohnwu/argh.git?rev=f0ca7d9d7f66b4ff56fbbd44ce19a96c625bffd8#f0ca7d9d7f66b4ff56fbbd44ce19a96c625bffd8"
+source = "git+https://github.com/google/argh.git?rev=1c632b046d084e7bde86b82dfc969b30b4647c8c#1c632b046d084e7bde86b82dfc969b30b4647c8c"
 dependencies = [
  "argh_shared",
  "proc-macro2",
  "quote",
- "syn 2.0.29",
+ "syn",
 ]
 
 [[package]]
 name = "argh_shared"
 version = "0.1.12"
-source = "git+https://github.com/topjohnwu/argh.git?rev=f0ca7d9d7f66b4ff56fbbd44ce19a96c625bffd8#f0ca7d9d7f66b4ff56fbbd44ce19a96c625bffd8"
+source = "git+https://github.com/google/argh.git?rev=1c632b046d084e7bde86b82dfc969b30b4647c8c#1c632b046d084e7bde86b82dfc969b30b4647c8c"
 dependencies = [
  "serde",
 ]
@@ -70,10 +70,13 @@ name = "base"
 version = "0.0.0"
 dependencies = [
  "argh",
+ "bytemuck",
  "cfg-if",
  "cxx",
  "cxx-gen",
  "libc",
+ "num-derive",
+ "num-traits",
  "thiserror",
 ]
 
@@ -105,16 +108,36 @@ dependencies = [
 ]
 
 [[package]]
-name = "byteorder"
-version = "1.4.3"
+name = "bytemuck"
+version = "1.14.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "14c189c53d098945499cdfa7ecc63567cf3886b3332b312a5b4585d8d3a6a610"
+checksum = "ed2490600f404f2b94c167e31d3ed1d5f3c225a0f3b80230053b3e0b7b962bd9"
+dependencies = [
+ "bytemuck_derive",
+]
+
+[[package]]
+name = "bytemuck_derive"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "965ab7eb5f8f97d2a083c799f3a1b994fc397b2fe2da5d1da1626ce15a39f2b1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "byteorder"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
 [[package]]
 name = "cc"
-version = "1.0.82"
+version = "1.0.83"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "305fe645edc1442a0fa8b6726ba61d422798d37a52e12eaecf4b022ebbb88f01"
+checksum = "f1174fb0b6ec23863f8b971027804a42614e347eafb0a95bf0b12cdae21fc4d0"
 dependencies = [
  "libc",
 ]
@@ -152,24 +175,24 @@ dependencies = [
 
 [[package]]
 name = "const-oid"
-version = "0.9.5"
+version = "0.9.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28c122c3980598d243d63d9a704629a2d748d101f278052ff068be5a4423ab6f"
+checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
 
 [[package]]
 name = "cpufeatures"
-version = "0.2.9"
+version = "0.2.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a17b76ff3a4162b0b27f354a0c87015ddad39d35f9c0c36607a3bdd175dde1f1"
+checksum = "53fe5e26ff1b7aef8bca9c6080520cfb8d9333c7568e1829cef191a9723e5504"
 dependencies = [
  "libc",
 ]
 
 [[package]]
 name = "crypto-bigint"
-version = "0.5.2"
+version = "0.5.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf4c2f4e1afd912bc40bfd6fed5d9dc1f288e0ba01bfcc835cc5bc3eb13efe15"
+checksum = "0dc92fb57ca44df6db8059111ab3af99a63d5d0f8375d9972e319a379c6bab76"
 dependencies = [
  "generic-array",
  "rand_core",
@@ -189,7 +212,7 @@ dependencies = [
 
 [[package]]
 name = "cxx"
-version = "1.0.105"
+version = "1.0.115"
 dependencies = [
  "cc",
  "cxxbridge-flags",
@@ -198,25 +221,25 @@ dependencies = [
 
 [[package]]
 name = "cxx-gen"
-version = "0.7.105"
+version = "0.7.115"
 dependencies = [
  "codespan-reporting",
  "proc-macro2",
  "quote",
- "syn 2.0.29",
+ "syn",
 ]
 
 [[package]]
 name = "cxxbridge-flags"
-version = "1.0.105"
+version = "1.0.115"
 
 [[package]]
 name = "cxxbridge-macro"
-version = "1.0.105"
+version = "1.0.115"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.29",
+ "syn",
 ]
 
 [[package]]
@@ -240,7 +263,7 @@ checksum = "5fe87ce4529967e0ba1dcf8450bab64d97dfd5010a6256187ffe2e43e6f0e049"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.29",
+ "syn",
 ]
 
 [[package]]
@@ -257,9 +280,9 @@ dependencies = [
 
 [[package]]
 name = "ecdsa"
-version = "0.16.8"
+version = "0.16.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4b1e0c257a9e9f25f90ff76d7a68360ed497ee519c8e428d1825ef0000799d4"
+checksum = "ee27f32b5c5292967d2d4a9d7f1e0b0aed2c15daded5a60300e4abb9d8020bca"
 dependencies = [
  "der",
  "digest",
@@ -271,9 +294,9 @@ dependencies = [
 
 [[package]]
 name = "elliptic-curve"
-version = "0.13.5"
+version = "0.13.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "968405c8fdc9b3bf4df0a6638858cc0b52462836ab6b1c87377785dd09cf1c0b"
+checksum = "b5e6043086bf7973472e0c7dff2142ea0b680d30e18d9cc40f267efbf222bd47"
 dependencies = [
  "base16ct",
  "crypto-bigint",
@@ -303,6 +326,12 @@ dependencies = [
  "termcolor",
 ]
 
+[[package]]
+name = "fdt"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "784a4df722dc6267a04af36895398f59d21d07dce47232adf31ec0ff2fa45e67"
+
 [[package]]
 name = "ff"
 version = "0.13.0"
@@ -315,9 +344,9 @@ dependencies = [
 
 [[package]]
 name = "flagset"
-version = "0.4.3"
+version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cda653ca797810c02f7ca4b804b40b8b95ae046eb989d356bce17919a8c25499"
+checksum = "d52a7e408202050813e6f1d9addadcaafef3dca7530c7ddfb005d4081cce6779"
 
 [[package]]
 name = "generic-array"
@@ -332,9 +361,9 @@ dependencies = [
 
 [[package]]
 name = "getrandom"
-version = "0.2.10"
+version = "0.2.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be4136b2a15dd319360be1c07d9933517ccf0be8f16bf62a3bee4f0d618df427"
+checksum = "190092ea657667030ac6a35e305e62fc4dd69fd98ac98631e5d3a2b1575a12b5"
 dependencies = [
  "cfg-if",
  "libc",
@@ -363,9 +392,9 @@ dependencies = [
 
 [[package]]
 name = "hkdf"
-version = "0.12.3"
+version = "0.12.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "791a029f6b9fc27657f6f188ec6e5e43f6911f6f878e0dc5501396e09809d437"
+checksum = "7b5f8eb2ad728638ea2c7d47a21db23b7b58a72ed6a38256b8a1849f15fbbdf7"
 dependencies = [
  "hmac",
 ]
@@ -399,15 +428,15 @@ dependencies = [
 
 [[package]]
 name = "libc"
-version = "0.2.147"
+version = "0.2.153"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4668fb0ea861c1df094127ac5f1da3409a82116a4ba74fca2e58ef927159bb3"
+checksum = "9c198f91728a82281a64e1f4f9eeb25d82cb32a5de251c6bd1b5154d63a8e7bd"
 
 [[package]]
 name = "libm"
-version = "0.2.7"
+version = "0.2.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f7012b1bbb0719e1097c47611d3898568c546d597c2e74d66f6087edd5233ff4"
+checksum = "4ec2a862134d2a7d32d7983ddcdd1c4923530833c9f2ea1a44fc5fa473989058"
 
 [[package]]
 name = "log"
@@ -420,10 +449,13 @@ name = "magisk"
 version = "0.0.0"
 dependencies = [
  "base",
+ "bytemuck",
  "cxx",
  "cxx-gen",
  "num-derive",
  "num-traits",
+ "pb-rs",
+ "quick-protobuf",
 ]
 
 [[package]]
@@ -432,11 +464,14 @@ version = "0.0.0"
 dependencies = [
  "argh",
  "base",
+ "bytemuck",
  "byteorder",
  "cxx",
  "cxx-gen",
  "der",
  "digest",
+ "fdt",
+ "num-traits",
  "p256",
  "p384",
  "pb-rs",
@@ -469,9 +504,9 @@ dependencies = [
 
 [[package]]
 name = "memchr"
-version = "2.5.0"
+version = "2.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"
+checksum = "523dc4f511e55ab87b694dc30d0f820d60906ef06413f93d4d7a1385599cc149"
 
 [[package]]
 name = "minimal-lexical"
@@ -508,13 +543,13 @@ dependencies = [
 
 [[package]]
 name = "num-derive"
-version = "0.3.3"
+version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "876a53fff98e03a936a674b29568b0e605f06b29372c2489ff4de23f1949743d"
+checksum = "cfb77679af88f8b125209d354a202862602672222e7f2313fdd6dc349bad4712"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 1.0.109",
+ "syn",
 ]
 
 [[package]]
@@ -540,9 +575,9 @@ dependencies = [
 
 [[package]]
 name = "num-traits"
-version = "0.2.16"
+version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f30b0abd723be7e2ffca1272140fac1a2f084c77ec3e123c192b66af1ee9e6c2"
+checksum = "39e3200413f237f41ab11ad6d161bc7239c84dcb631773ccd7de3dfe4b5c267c"
 dependencies = [
  "autocfg",
  "libm",
@@ -621,18 +656,18 @@ checksum = "5b40af805b3121feab8a3c29f04d8ad262fa8e0561883e7653e024ae4479e6de"
 
 [[package]]
 name = "primeorder"
-version = "0.13.2"
+version = "0.13.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c2fcef82c0ec6eefcc179b978446c399b3cdf73c392c35604e399eee6df1ee3"
+checksum = "353e1ca18966c16d9deb1c69278edbc5f194139612772bd9537af60ac231e1e6"
 dependencies = [
  "elliptic-curve",
 ]
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.66"
+version = "1.0.78"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "18fb31db3f9bddb2ea821cde30a9f70117e3f119938b5ee630b7403aa6e2ead9"
+checksum = "e2422ad645d89c99f8f3e6b88a9fdeca7fabeac836b1002371c4367c8f984aae"
 dependencies = [
  "unicode-ident",
 ]
@@ -653,9 +688,9 @@ dependencies = [
 
 [[package]]
 name = "quote"
-version = "1.0.33"
+version = "1.0.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5267fca4496028628a95160fc423a33e8b2e6af8a5302579e322e4b520293cae"
+checksum = "291ec9ab5efd934aaf503a6466c5d5251535d108ee747472c3977cc5acc868ef"
 dependencies = [
  "proc-macro2",
 ]
@@ -691,9 +726,9 @@ dependencies = [
 
 [[package]]
 name = "regex"
-version = "1.9.3"
+version = "1.10.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81bc1d4caf89fac26a70747fe603c130093b53c773888797a6329091246d651a"
+checksum = "b62dbe01f0b06f9d8dc7d49e05a0785f153b00b2c227856282f671e0318c9b15"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -703,9 +738,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.3.6"
+version = "0.4.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fed1ceff11a1dddaee50c9dc8e4938bd106e9d89ae372f192311e7da498e3b69"
+checksum = "5bb987efffd3c6d0d8f5f89510bb458559eab11e4f869acb20bf845e016259cd"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -714,9 +749,9 @@ dependencies = [
 
 [[package]]
 name = "regex-syntax"
-version = "0.7.4"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5ea92a5b6195c6ef2a0295ea818b312502c6fc94dde986c5553242e18fd4ce2"
+checksum = "c08c74e62047bb2de4ff487b251e4a92e24f48745648451635cec7d591162d9f"
 
 [[package]]
 name = "rfc6979"
@@ -730,16 +765,14 @@ dependencies = [
 
 [[package]]
 name = "rsa"
-version = "0.9.2"
+version = "0.9.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ab43bb47d23c1a631b4b680199a45255dce26fa9ab2fa902581f624ff13e6a8"
+checksum = "5d0e5124fcb30e76a7e79bfee683a2746db83784b86289f6251b54b7950a0dfc"
 dependencies = [
- "byteorder",
  "const-oid",
  "digest",
  "num-bigint-dig",
  "num-integer",
- "num-iter",
  "num-traits",
  "pkcs1",
  "pkcs8",
@@ -767,29 +800,29 @@ dependencies = [
 
 [[package]]
 name = "serde"
-version = "1.0.183"
+version = "1.0.196"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32ac8da02677876d532745a130fc9d8e6edfa81a269b107c5b00829b91d8eb3c"
+checksum = "870026e60fa08c69f064aa766c10f10b1d62db9ccd4d0abb206472bee0ce3b32"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.183"
+version = "1.0.196"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aafe972d60b0b9bee71a91b92fee2d4fb3c9d7e8f6b179aa99f27203d99a4816"
+checksum = "33c85360c95e7d137454dc81d9a4ed2b8efd8fbe19cee57357b32b9771fccb67"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.29",
+ "syn",
 ]
 
 [[package]]
 name = "sha1"
-version = "0.10.5"
+version = "0.10.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f04293dc80c3993519f2d7f6f511707ee7094fe0c6d3406feb330cdb3540eba3"
+checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba"
 dependencies = [
  "cfg-if",
  "cpufeatures",
@@ -798,9 +831,9 @@ dependencies = [
 
 [[package]]
 name = "sha2"
-version = "0.10.7"
+version = "0.10.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "479fb9d862239e610720565ca91403019f2f00410f1864c5aa7479b950a76ed8"
+checksum = "793db75ad2bcafc3ffa7c68b215fee268f537982cd901d132f89c6343f3a3dc8"
 dependencies = [
  "cfg-if",
  "cpufeatures",
@@ -809,9 +842,9 @@ dependencies = [
 
 [[package]]
 name = "signature"
-version = "2.1.0"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e1788eed21689f9cf370582dfc467ef36ed9c707f073528ddafa8d83e3b8500"
+checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
 dependencies = [
  "digest",
  "rand_core",
@@ -825,9 +858,9 @@ checksum = "9fed904c7fb2856d868b92464fc8fa597fce366edea1a9cbfaa8cb5fe080bd6d"
 
 [[package]]
 name = "smallvec"
-version = "1.11.0"
+version = "1.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62bb4feee49fdd9f707ef802e22365a35de4b7b299de4763d44bfea899442ff9"
+checksum = "e6ecd384b10a64542d77071bd64bd7b231f4ed5940fba55e98c3de13824cf3d7"
 
 [[package]]
 name = "spin"
@@ -837,9 +870,9 @@ checksum = "6e63cff320ae2c57904679ba7cb63280a3dc4613885beafb148ee7bf9aa9042d"
 
 [[package]]
 name = "spki"
-version = "0.7.2"
+version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d1e996ef02c474957d681f1b05213dfb0abab947b446a62d37770b23500184a"
+checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
 dependencies = [
  "base64ct",
  "der",
@@ -859,20 +892,9 @@ checksum = "81cdd64d312baedb58e21336b31bc043b77e01cc99033ce76ef539f78e965ebc"
 
 [[package]]
 name = "syn"
-version = "1.0.109"
+version = "2.0.48"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
-[[package]]
-name = "syn"
-version = "2.0.29"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c324c494eba9d92503e6f1ef2e6df781e78f6a7705a0202d9801b198807d518a"
+checksum = "0f3531638e407dfc0814761abb7c00a5b54992b849452a0646b7f65c9f770f3f"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -881,9 +903,9 @@ dependencies = [
 
 [[package]]
 name = "termcolor"
-version = "1.2.0"
+version = "1.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be55cf8942feac5c765c2c993422806843c9a9a45d4d5c407ad6dd2ea95eb9b6"
+checksum = "06794f8f6c5c898b3275aebefa6b8a1cb24cd2c6c79397ab15774837a0bc5755"
 dependencies = [
  "winapi-util",
 ]
@@ -899,41 +921,62 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "1.0.47"
+version = "1.0.56"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97a802ec30afc17eee47b2855fc72e0c4cd62be9b4efe6591edde0ec5bd68d8f"
+checksum = "d54378c645627613241d077a3a79db965db602882668f9136ac42af9ecb730ad"
 dependencies = [
  "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "1.0.47"
+version = "1.0.56"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6bb623b56e39ab7dcd4b1b98bb6c8f8d907ed255b18de254088016b27a8ee19b"
+checksum = "fa0faa943b50f3db30a20aa7e265dbc66076993efed8463e8de414e5d06d3471"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.29",
+ "syn",
+]
+
+[[package]]
+name = "tls_codec"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5e78c9c330f8c85b2bae7c8368f2739157db9991235123aa1b15ef9502bfb6a"
+dependencies = [
+ "tls_codec_derive",
+ "zeroize",
+]
+
+[[package]]
+name = "tls_codec_derive"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8d9ef545650e79f30233c0003bcc2504d7efac6dad25fca40744de773fe2049c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
 ]
 
 [[package]]
 name = "typenum"
-version = "1.16.0"
+version = "1.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "497961ef93d974e23eb6f433eb5fe1b7930b659f06d12dec6fc44a8f554c0bba"
+checksum = "42ff0bf0c66b8238c6f3b578df37d0b7848e55df8577b3f74f92a69acceeb825"
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.11"
+version = "1.0.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "301abaae475aa91687eb82514b328ab47a211a533026cb25fc3e519b86adfc3c"
+checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
 
 [[package]]
 name = "unicode-width"
-version = "0.1.10"
+version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0edd1e5b14653f783770bce4a4dabb4a5108a5370a5f5d8cfe8710c361f6c8b"
+checksum = "e51733f11c9c4f72aa0c160008246859e340b00807569a0da0e7a1079b27ba85"
 
 [[package]]
 name = "vec_map"
@@ -971,9 +1014,9 @@ checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
 
 [[package]]
 name = "winapi-util"
-version = "0.1.5"
+version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70ec6ce85bb158151cae5e5c87f95a8e97d2c0c4b001223f33a334e3ce5de178"
+checksum = "f29e6f9198ba0d26b4c9f07dbe6f9ed633e1f3d5b8b414090084349e46a52596"
 dependencies = [
  "winapi",
 ]
@@ -986,17 +1029,32 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "x509-cert"
-version = "0.2.4"
+version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "25eefca1d99701da3a57feb07e5079fc62abba059fc139e98c13bbb250f3ef29"
+checksum = "1301e935010a701ae5f8655edc0ad17c44bad3ac5ce8c39185f75453b720ae94"
 dependencies = [
  "const-oid",
  "der",
  "spki",
+ "tls_codec",
 ]
 
 [[package]]
 name = "zeroize"
-version = "1.6.0"
+version = "1.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a0956f1ba7c7909bfb66c2e9e4124ab6f6482560f6628b5aaeba39207c9aad9"
+checksum = "525b4ec142c6b68a2d10f01f7bbf6755599ca3f81ea53b8431b7dd348f5fdb2d"
+dependencies = [
+ "zeroize_derive",
+]
+
+[[package]]
+name = "zeroize_derive"
+version = "1.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce36e65b0d2999d2aafac989fb249189a141aee1f53c612c1f37d72631959f69"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]

native/src/Cargo.toml

@@ -9,7 +9,7 @@ cxx-gen = { path = "external/cxx-rs/gen/lib" }
 libc = "0.2"
 cfg-if = "1.0"
 num-traits = "0.2"
-num-derive = "0.3"
+num-derive = "0.4"
 thiserror = "1.0"
 byteorder = "1"
 size = "0.4"
@@ -21,10 +21,13 @@ p384 = "0.13"
 rsa = "0.9"
 x509-cert = "0.2"
 der = "0.7"
+bytemuck = "1.14"
+fdt = "0.1"
 
 [workspace.dependencies.argh]
-git = "https://github.com/topjohnwu/argh.git"
-rev = "f0ca7d9d7f66b4ff56fbbd44ce19a96c625bffd8"
+git = "https://github.com/google/argh.git"
+rev = "1c632b046d084e7bde86b82dfc969b30b4647c8c"
+default-features = false
 
 [workspace.dependencies.pb-rs]
 git = "https://github.com/tafia/quick-protobuf.git"

native/src/base/Android.mk

@@ -17,7 +17,6 @@ LOCAL_SRC_FILES := \
     new.cpp \
     files.cpp \
     misc.cpp \
-    selinux.cpp \
     logging.cpp \
     stream.cpp \
     base-rs.cpp \

native/src/base/Cargo.toml

@@ -6,6 +6,10 @@ edition = "2021"
 [lib]
 path = "lib.rs"
 
+[features]
+selinux = []
+dyn_selinux = []
+
 [build-dependencies]
 cxx-gen = { workspace = true }
 
@@ -15,3 +19,6 @@ libc = { workspace = true }
 cfg-if = { workspace = true }
 thiserror = { workspace = true }
 argh = { workspace = true }
+bytemuck = { workspace = true }
+num-traits = { workspace = true }
+num-derive = { workspace = true }

native/src/base/compat/compat.cpp

@@ -7,6 +7,7 @@
 #include <unistd.h>
 #include <fcntl.h>
 #include <sys/syscall.h>
+#include <sys/xattr.h>
 
 extern "C" {
 
@@ -90,6 +91,16 @@ int mkfifo(const char *path, mode_t mode) {
     return mknod(path, (mode & ~S_IFMT) | S_IFIFO, 0);
 }
 
+[[gnu::weak]]
+int fsetxattr(int fd, const char *name, const void *value, size_t size, int flags) {
+    return syscall(__NR_fsetxattr, fd, name, value, size, flags);
+}
+
+[[gnu::weak]]
+int lsetxattr(const char *path, const char *name, const void *value, size_t size, int flags) {
+    return syscall(__NR_lsetxattr, path, name, value, size, flags);
+}
+
 #define SPLIT_64(v) (unsigned)((v) & 0xFFFFFFFF), (unsigned)((v) >> 32)
 
 #if defined(__arm__)

native/src/base/cstr.rs

@@ -0,0 +1,653 @@
+use std::cmp::min;
+use std::ffi::{CStr, FromBytesWithNulError, OsStr};
+use std::fmt::{Arguments, Debug, Display, Formatter, Write};
+use std::ops::{Deref, DerefMut};
+use std::path::Path;
+use std::str::{Utf8Chunks, Utf8Error};
+use std::{fmt, mem, slice, str};
+
+use cxx::{type_id, ExternType};
+use libc::c_char;
+use thiserror::Error;
+
+use crate::slice_from_ptr_mut;
+
+// Utf8CStr types are UTF-8 validated and null terminated strings.
+//
+// Several Utf8CStr types:
+//
+// Utf8CStr: can only exist as reference, similar to &str
+// Utf8CString: dynamically sized buffer allocated on the heap
+// Utf8CStrBufRef: reference to a fixed sized buffer
+// Utf8CStrBufArr<N>: fixed sized buffer allocated on the stack
+//
+// In most cases, these are the types being used
+//
+// &Utf8CStr: whenever a printable null terminated string is needed
+// &mut dyn Utf8CStrWrite: whenever we need a buffer that only needs to support appending
+//                         strings to the end, and has to be null terminated
+// &mut dyn Utf8CStrBuf: whenever we need a pre-allocated buffer that is large enough to fit
+//                       in the result, and has to be null terminated
+//
+// All types dereferences to &Utf8CStr.
+// Utf8CString, Utf8CStrBufRef, and Utf8CStrBufArr<N> implements Utf8CStrWrite.
+// Utf8CStrBufRef and Utf8CStrBufArr<N> implements Utf8CStrBuf.
+
+pub fn copy_cstr<T: AsRef<CStr> + ?Sized>(dest: &mut [u8], src: &T) -> usize {
+    let src = src.as_ref().to_bytes_with_nul();
+    let len = min(src.len(), dest.len());
+    dest[..len].copy_from_slice(&src[..len]);
+    len - 1
+}
+
+fn utf8_cstr_buf_append(buf: &mut dyn Utf8CStrBuf, s: &[u8]) -> usize {
+    let mut used = buf.len();
+    if used >= buf.capacity() - 1 {
+        // Truncate
+        return 0;
+    }
+    let dest = unsafe { &mut buf.mut_buf()[used..] };
+    let len = min(s.len(), dest.len() - 1);
+    dest[..len].copy_from_slice(&s[..len]);
+    dest[len] = b'\0';
+    used += len;
+    unsafe { buf.set_len(used) };
+    len
+}
+
+fn utf8_cstr_append_lossy(buf: &mut dyn Utf8CStrWrite, s: &[u8]) -> usize {
+    let chunks = Utf8Chunks::new(s);
+    let mut len = 0_usize;
+    for chunk in chunks {
+        len += buf.push_str(chunk.valid());
+        if !chunk.invalid().is_empty() {
+            len += buf.push_str(char::REPLACEMENT_CHARACTER.encode_utf8(&mut [0; 4]));
+        }
+    }
+    len
+}
+
+// Trait definitions
+
+pub trait Utf8CStrWrite:
+    Write + AsRef<Utf8CStr> + AsMut<Utf8CStr> + Deref<Target = Utf8CStr> + DerefMut
+{
+    fn len(&self) -> usize;
+    #[inline(always)]
+    fn is_empty(&self) -> bool {
+        self.len() == 0
+    }
+    fn push_str(&mut self, s: &str) -> usize;
+    fn push_lossy(&mut self, s: &[u8]) -> usize;
+    fn clear(&mut self);
+}
+
+pub trait Utf8CStrBuf: Utf8CStrWrite {
+    fn buf(&self) -> &[u8];
+
+    // Modifying the underlying buffer or length is unsafe because it can either:
+    // 1. Break null termination
+    // 2. Break UTF-8 validation
+    // 3. Introduce inner null byte in the string
+    unsafe fn mut_buf(&mut self) -> &mut [u8];
+    unsafe fn set_len(&mut self, len: usize);
+
+    #[inline(always)]
+    fn capacity(&self) -> usize {
+        self.buf().len()
+    }
+}
+
+trait AsUtf8CStr {
+    fn as_utf8_cstr(&self) -> &Utf8CStr;
+    fn as_utf8_cstr_mut(&mut self) -> &mut Utf8CStr;
+}
+
+// Implementation for Utf8CString
+
+trait StringExt {
+    fn nul_terminate(&mut self) -> &mut [u8];
+}
+
+impl StringExt for String {
+    fn nul_terminate(&mut self) -> &mut [u8] {
+        self.reserve(1);
+        // SAFETY: the string is reserved to have enough capacity to fit in the null byte
+        // SAFETY: the null byte is explicitly added outside of the string's length
+        unsafe {
+            let buf = slice::from_raw_parts_mut(self.as_mut_ptr(), self.len() + 1);
+            *buf.get_unchecked_mut(self.len()) = b'\0';
+            buf
+        }
+    }
+}
+
+#[derive(Default)]
+pub struct Utf8CString(String);
+
+impl Utf8CString {
+    #[inline(always)]
+    pub fn new() -> Self {
+        Self::default()
+    }
+}
+
+impl AsUtf8CStr for Utf8CString {
+    #[inline(always)]
+    fn as_utf8_cstr(&self) -> &Utf8CStr {
+        // SAFETY: the internal string is always null terminated
+        unsafe { mem::transmute(slice::from_raw_parts(self.0.as_ptr(), self.0.len() + 1)) }
+    }
+
+    #[inline(always)]
+    fn as_utf8_cstr_mut(&mut self) -> &mut Utf8CStr {
+        Utf8CStr::from_string(&mut self.0)
+    }
+}
+
+impl Utf8CStrWrite for Utf8CString {
+    #[inline(always)]
+    fn len(&self) -> usize {
+        self.0.len()
+    }
+
+    fn push_str(&mut self, s: &str) -> usize {
+        self.0.push_str(s);
+        self.0.nul_terminate();
+        s.len()
+    }
+
+    #[inline(always)]
+    fn push_lossy(&mut self, s: &[u8]) -> usize {
+        utf8_cstr_append_lossy(self, s)
+    }
+
+    fn clear(&mut self) {
+        self.0.clear();
+        self.0.nul_terminate();
+    }
+}
+
+impl From<String> for Utf8CString {
+    fn from(mut value: String) -> Self {
+        value.nul_terminate();
+        Utf8CString(value)
+    }
+}
+
+// Implementations for Utf8CStrBuf
+
+impl<T: Utf8CStrBuf> AsUtf8CStr for T {
+    #[inline(always)]
+    fn as_utf8_cstr(&self) -> &Utf8CStr {
+        // SAFETY: the internal buffer is always UTF-8 checked
+        // SAFETY: self.used is guaranteed to always <= SIZE - 1
+        unsafe { Utf8CStr::from_bytes_unchecked(self.buf().get_unchecked(..(self.len() + 1))) }
+    }
+
+    #[inline(always)]
+    fn as_utf8_cstr_mut(&mut self) -> &mut Utf8CStr {
+        // SAFETY: the internal buffer is always UTF-8 checked
+        // SAFETY: self.used is guaranteed to always <= SIZE - 1
+        unsafe {
+            let len = self.len() + 1;
+            Utf8CStr::from_bytes_unchecked_mut(self.mut_buf().get_unchecked_mut(..len))
+        }
+    }
+}
+
+// UTF-8 validated + null terminated reference to buffer
+pub struct Utf8CStrBufRef<'a> {
+    used: usize,
+    buf: &'a mut [u8],
+}
+
+impl<'a> Utf8CStrBufRef<'a> {
+    pub unsafe fn from_ptr(buf: *mut u8, len: usize) -> Utf8CStrBufRef<'a> {
+        Self::from(slice_from_ptr_mut(buf, len))
+    }
+}
+
+impl<'a> From<&'a mut [u8]> for Utf8CStrBufRef<'a> {
+    fn from(buf: &'a mut [u8]) -> Utf8CStrBufRef<'a> {
+        buf[0] = b'\0';
+        Utf8CStrBufRef { used: 0, buf }
+    }
+}
+
+impl Utf8CStrBuf for Utf8CStrBufRef<'_> {
+    #[inline(always)]
+    fn buf(&self) -> &[u8] {
+        self.buf
+    }
+
+    #[inline(always)]
+    unsafe fn mut_buf(&mut self) -> &mut [u8] {
+        self.buf
+    }
+
+    #[inline(always)]
+    unsafe fn set_len(&mut self, len: usize) {
+        self.used = len;
+    }
+}
+
+// UTF-8 validated + null terminated buffer on the stack
+pub struct Utf8CStrBufArr<const N: usize> {
+    used: usize,
+    buf: [u8; N],
+}
+
+impl<const N: usize> Utf8CStrBufArr<N> {
+    pub fn new() -> Self {
+        Utf8CStrBufArr {
+            used: 0,
+            buf: [0; N],
+        }
+    }
+}
+
+impl<const N: usize> Utf8CStrBuf for Utf8CStrBufArr<N> {
+    #[inline(always)]
+    fn buf(&self) -> &[u8] {
+        &self.buf
+    }
+
+    #[inline(always)]
+    unsafe fn mut_buf(&mut self) -> &mut [u8] {
+        &mut self.buf
+    }
+
+    #[inline(always)]
+    unsafe fn set_len(&mut self, len: usize) {
+        self.used = len;
+    }
+
+    #[inline(always)]
+    fn capacity(&self) -> usize {
+        N
+    }
+}
+
+impl Default for Utf8CStrBufArr<4096> {
+    fn default() -> Self {
+        Utf8CStrBufArr::<4096>::new()
+    }
+}
+
+#[derive(Debug, Error)]
+pub enum StrErr {
+    #[error(transparent)]
+    Utf8Error(#[from] Utf8Error),
+    #[error(transparent)]
+    CStrError(#[from] FromBytesWithNulError),
+    #[error("argument is null")]
+    NullPointerError,
+}
+
+// UTF-8 validated + null terminated string slice
+#[repr(transparent)]
+pub struct Utf8CStr([u8]);
+
+impl Utf8CStr {
+    pub fn from_cstr(cstr: &CStr) -> Result<&Utf8CStr, StrErr> {
+        // Validate the buffer during construction
+        str::from_utf8(cstr.to_bytes())?;
+        Ok(unsafe { Self::from_bytes_unchecked(cstr.to_bytes_with_nul()) })
+    }
+
+    pub fn from_bytes(buf: &[u8]) -> Result<&Utf8CStr, StrErr> {
+        Self::from_cstr(CStr::from_bytes_with_nul(buf)?)
+    }
+
+    pub fn from_bytes_mut(buf: &mut [u8]) -> Result<&mut Utf8CStr, StrErr> {
+        CStr::from_bytes_with_nul(buf)?;
+        str::from_utf8(buf)?;
+        // Both condition checked
+        unsafe { Ok(mem::transmute(buf)) }
+    }
+
+    pub fn from_string(s: &mut String) -> &mut Utf8CStr {
+        let buf = s.nul_terminate();
+        // SAFETY: the null byte is explicitly added to the buffer
+        unsafe { mem::transmute(buf) }
+    }
+
+    #[inline(always)]
+    pub unsafe fn from_bytes_unchecked(buf: &[u8]) -> &Utf8CStr {
+        mem::transmute(buf)
+    }
+
+    #[inline(always)]
+    pub unsafe fn from_bytes_unchecked_mut(buf: &mut [u8]) -> &mut Utf8CStr {
+        mem::transmute(buf)
+    }
+
+    pub unsafe fn from_ptr<'a>(ptr: *const c_char) -> Result<&'a Utf8CStr, StrErr> {
+        if ptr.is_null() {
+            return Err(StrErr::NullPointerError);
+        }
+        Self::from_cstr(unsafe { CStr::from_ptr(ptr) })
+    }
+
+    #[inline(always)]
+    pub fn as_bytes_with_nul(&self) -> &[u8] {
+        &self.0
+    }
+
+    #[inline(always)]
+    pub fn as_ptr(&self) -> *const c_char {
+        self.0.as_ptr().cast()
+    }
+
+    #[inline(always)]
+    pub fn as_mut_ptr(&mut self) -> *mut c_char {
+        self.0.as_mut_ptr().cast()
+    }
+
+    #[inline(always)]
+    pub fn as_cstr(&self) -> &CStr {
+        // SAFETY: Already validated as null terminated during construction
+        unsafe { CStr::from_bytes_with_nul_unchecked(&self.0) }
+    }
+
+    #[inline(always)]
+    pub fn as_str(&self) -> &str {
+        // SAFETY: Already UTF-8 validated during construction
+        // SAFETY: The length of the slice is at least 1 due to null termination check
+        unsafe { str::from_utf8_unchecked(self.0.get_unchecked(..self.0.len() - 1)) }
+    }
+
+    #[inline(always)]
+    pub fn as_str_mut(&mut self) -> &mut str {
+        // SAFETY: Already UTF-8 validated during construction
+        // SAFETY: The length of the slice is at least 1 due to null termination check
+        unsafe { str::from_utf8_unchecked_mut(self.0.get_unchecked_mut(..self.0.len() - 1)) }
+    }
+}
+
+impl Deref for Utf8CStr {
+    type Target = str;
+
+    #[inline(always)]
+    fn deref(&self) -> &str {
+        self.as_str()
+    }
+}
+
+impl DerefMut for Utf8CStr {
+    #[inline(always)]
+    fn deref_mut(&mut self) -> &mut Self::Target {
+        self.as_str_mut()
+    }
+}
+
+// Notice that we only implement ExternType on Utf8CStr *reference*
+unsafe impl ExternType for &Utf8CStr {
+    type Id = type_id!("rust::Utf8CStr");
+    type Kind = cxx::kind::Trivial;
+}
+
+macro_rules! const_assert_eq {
+    ($left:expr, $right:expr $(,)?) => {
+        const _: [(); $left] = [(); $right];
+    };
+}
+
+// Assert ABI layout
+const_assert_eq!(mem::size_of::<&Utf8CStr>(), mem::size_of::<[usize; 2]>());
+const_assert_eq!(mem::align_of::<&Utf8CStr>(), mem::align_of::<[usize; 2]>());
+
+// File system path extensions types
+
+#[repr(transparent)]
+pub struct FsPath(Utf8CStr);
+
+impl FsPath {
+    #[inline(always)]
+    pub fn from<T: AsRef<Utf8CStr> + ?Sized>(value: &T) -> &FsPath {
+        unsafe { mem::transmute(value.as_ref()) }
+    }
+
+    #[inline(always)]
+    pub fn from_mut<T: AsMut<Utf8CStr> + ?Sized>(value: &mut T) -> &mut FsPath {
+        unsafe { mem::transmute(value.as_mut()) }
+    }
+}
+
+impl Deref for FsPath {
+    type Target = Utf8CStr;
+
+    #[inline(always)]
+    fn deref(&self) -> &Utf8CStr {
+        &self.0
+    }
+}
+
+impl DerefMut for FsPath {
+    #[inline(always)]
+    fn deref_mut(&mut self) -> &mut Utf8CStr {
+        &mut self.0
+    }
+}
+
+pub struct FsPathBuf<'a>(&'a mut dyn Utf8CStrWrite);
+
+impl<'a> FsPathBuf<'a> {
+    pub fn new(value: &'a mut dyn Utf8CStrWrite) -> Self {
+        FsPathBuf(value)
+    }
+
+    pub fn join<T: AsRef<str>>(self, path: T) -> Self {
+        fn inner(buf: &mut dyn Utf8CStrWrite, path: &str) {
+            if path.starts_with('/') {
+                buf.clear();
+            } else {
+                buf.push_str("/");
+            }
+            buf.push_str(path);
+        }
+        inner(self.0, path.as_ref());
+        self
+    }
+
+    pub fn join_fmt<T: Display>(self, name: T) -> Self {
+        fn inner(buf: &mut dyn Utf8CStrWrite, path: Arguments) {
+            buf.write_fmt(path).ok();
+        }
+        inner(self.0, format_args!("/{}", name));
+        self
+    }
+}
+
+impl<'a> Deref for FsPathBuf<'a> {
+    type Target = FsPath;
+
+    fn deref(&self) -> &FsPath {
+        FsPath::from(&self.0)
+    }
+}
+
+impl<'a> DerefMut for FsPathBuf<'a> {
+    fn deref_mut(&mut self) -> &mut Self::Target {
+        FsPath::from_mut(&mut self.0)
+    }
+}
+
+// Boilerplate trait implementations
+
+macro_rules! impl_str {
+    ($( ($t:ty, $($g:tt)*) )*) => {$(
+        impl<$($g)*> AsRef<Utf8CStr> for $t {
+            #[inline(always)]
+            fn as_ref(&self) -> &Utf8CStr {
+                self
+            }
+        }
+        impl<$($g)*> AsRef<str> for $t {
+            #[inline(always)]
+            fn as_ref(&self) -> &str {
+                self.as_str()
+            }
+        }
+        impl<$($g)*> AsRef<CStr> for $t {
+            #[inline(always)]
+            fn as_ref(&self) -> &CStr {
+                self.as_cstr()
+            }
+        }
+        impl<$($g)*> AsRef<OsStr> for $t {
+            #[inline(always)]
+            fn as_ref(&self) -> &OsStr {
+                OsStr::new(self.as_str())
+            }
+        }
+        impl<$($g)*> AsRef<Path> for $t {
+            #[inline(always)]
+            fn as_ref(&self) -> &Path {
+                Path::new(self.as_str())
+            }
+        }
+        impl<$($g)*> Display for $t {
+            #[inline(always)]
+            fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
+                Display::fmt(self.as_str(), f)
+            }
+        }
+        impl<$($g)*> Debug for $t {
+            #[inline(always)]
+            fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
+                Debug::fmt(self.as_str(), f)
+            }
+        }
+        impl<$($g)*> PartialEq<str> for $t {
+            #[inline(always)]
+            fn eq(&self, other: &str) -> bool {
+                self.as_str() == other
+            }
+        }
+        impl<$($g)*> PartialEq<$t> for str {
+            #[inline(always)]
+            fn eq(&self, other: &$t) -> bool {
+                self == other.as_str()
+            }
+        }
+        impl<$($g)*> PartialEq<CStr> for $t {
+            #[inline(always)]
+            fn eq(&self, other: &CStr) -> bool {
+                self.as_cstr() == other
+            }
+        }
+        impl<$($g)*> PartialEq<$t> for CStr {
+            #[inline(always)]
+            fn eq(&self, other: &$t) -> bool {
+                self == other.as_cstr()
+            }
+        }
+        impl<T: AsRef<Utf8CStr>, $($g)*> PartialEq<T> for $t {
+            #[inline(always)]
+            fn eq(&self, other: &T) -> bool {
+                self.as_bytes_with_nul() == other.as_ref().as_bytes_with_nul()
+            }
+        }
+    )*}
+}
+
+impl_str!(
+    (Utf8CStr,)
+    (FsPath,)
+    (FsPathBuf<'_>,)
+    (Utf8CStrBufRef<'_>,)
+    (Utf8CStrBufArr<N>, const N: usize)
+    (Utf8CString,)
+);
+
+macro_rules! impl_str_write {
+    ($( ($t:ty, $($g:tt)*) )*) => {$(
+        impl<$($g)*> Write for $t {
+            #[inline(always)]
+            fn write_str(&mut self, s: &str) -> fmt::Result {
+                self.push_str(s);
+                Ok(())
+            }
+        }
+        impl<$($g)*> Deref for $t {
+            type Target = Utf8CStr;
+
+            #[inline(always)]
+            fn deref(&self) -> &Utf8CStr {
+                self.as_utf8_cstr()
+            }
+        }
+        impl<$($g)*> DerefMut for $t {
+            #[inline(always)]
+            fn deref_mut(&mut self) -> &mut Utf8CStr {
+                self.as_utf8_cstr_mut()
+            }
+        }
+        impl<$($g)*> AsMut<Utf8CStr> for $t {
+            #[inline(always)]
+            fn as_mut(&mut self) -> &mut Utf8CStr {
+                self.as_utf8_cstr_mut()
+            }
+        }
+    )*}
+}
+
+impl_str_write!(
+    (Utf8CStrBufRef<'_>,)
+    (Utf8CStrBufArr<N>, const N: usize)
+    (Utf8CString,)
+);
+
+macro_rules! impl_str_buf {
+    ($( ($t:ty, $($g:tt)*) )*) => {$(
+        impl<$($g)*> Utf8CStrWrite for $t {
+            #[inline(always)]
+            fn len(&self) -> usize {
+                self.used
+            }
+            #[inline(always)]
+            fn push_str(&mut self, s: &str) -> usize {
+                utf8_cstr_buf_append(self, s.as_bytes())
+            }
+            #[inline(always)]
+            fn push_lossy(&mut self, s: &[u8]) -> usize {
+                utf8_cstr_append_lossy(self, s)
+            }
+            #[inline(always)]
+            fn clear(&mut self) {
+                self.buf[0] = b'\0';
+                self.used = 0;
+            }
+        }
+    )*}
+}
+
+impl_str_buf!(
+    (Utf8CStrBufRef<'_>,)
+    (Utf8CStrBufArr<N>, const N: usize)
+);
+
+// The cstr! macro is copied from https://github.com/bytecodealliance/rustix/blob/main/src/cstr.rs
+
+#[macro_export]
+macro_rules! cstr {
+    ($($str:tt)*) => {{
+        assert!(
+            !($($str)*).bytes().any(|b| b == b'\0'),
+            "cstr argument contains embedded NUL bytes",
+        );
+        #[allow(unused_unsafe)]
+        unsafe {
+            $crate::Utf8CStr::from_bytes_unchecked(concat!($($str)*, "\0").as_bytes())
+        }
+    }};
+}
+
+#[macro_export]
+macro_rules! raw_cstr {
+    ($($str:tt)*) => {{
+        cstr!($($str)*).as_ptr()
+    }};
+}

native/src/base/cxx_extern.rs

@@ -1,28 +1,35 @@
 // Functions in this file are only for exporting to C++, DO NOT USE IN RUST
 
-use std::fmt::Write;
 use std::io;
 use std::os::fd::{BorrowedFd, OwnedFd, RawFd};
 
+use cfg_if::cfg_if;
 use cxx::private::c_char;
 use libc::mode_t;
 
+use crate::logging::CxxResultExt;
 pub(crate) use crate::xwrap::*;
 use crate::{
-    fd_path, map_fd, map_file, mkdirs, realpath, rm_rf, slice_from_ptr_mut, Directory, ResultExt,
-    Utf8CStr,
+    clone_attr, cstr, fclone_attr, fd_path, map_fd, map_file, slice_from_ptr, Directory, FsPath,
+    Utf8CStr, Utf8CStrBufRef,
 };
 
 pub(crate) fn fd_path_for_cxx(fd: RawFd, buf: &mut [u8]) -> isize {
-    fd_path(fd, buf)
+    let mut buf = Utf8CStrBufRef::from(buf);
+    fd_path(fd, &mut buf)
         .log_cxx_with_msg(|w| w.write_str("fd_path failed"))
-        .map_or(-1_isize, |v| v as isize)
+        .map_or(-1_isize, |_| buf.len() as isize)
 }
 
 #[no_mangle]
 unsafe extern "C" fn canonical_path(path: *const c_char, buf: *mut u8, bufsz: usize) -> isize {
     match Utf8CStr::from_ptr(path) {
-        Ok(p) => realpath(p, slice_from_ptr_mut(buf, bufsz)).map_or(-1, |v| v as isize),
+        Ok(p) => {
+            let mut buf = Utf8CStrBufRef::from_ptr(buf, bufsz);
+            FsPath::from(p)
+                .realpath(&mut buf)
+                .map_or(-1, |_| buf.len() as isize)
+        }
         Err(_) => -1,
     }
 }
@@ -30,7 +37,7 @@ unsafe extern "C" fn canonical_path(path: *const c_char, buf: *mut u8, bufsz: us
 #[export_name = "mkdirs"]
 unsafe extern "C" fn mkdirs_for_cxx(path: *const c_char, mode: mode_t) -> i32 {
     match Utf8CStr::from_ptr(path) {
-        Ok(p) => mkdirs(p, mode).map_or(-1, |_| 0),
+        Ok(p) => FsPath::from(p).mkdirs(mode).map_or(-1, |_| 0),
         Err(_) => -1,
     }
 }
@@ -38,7 +45,7 @@ unsafe extern "C" fn mkdirs_for_cxx(path: *const c_char, mode: mode_t) -> i32 {
 #[export_name = "rm_rf"]
 unsafe extern "C" fn rm_rf_for_cxx(path: *const c_char) -> bool {
     match Utf8CStr::from_ptr(path) {
-        Ok(p) => rm_rf(p).map_or(false, |_| true),
+        Ok(p) => FsPath::from(p).remove_all().is_ok(),
         Err(_) => false,
     }
 }
@@ -48,15 +55,11 @@ unsafe extern "C" fn frm_rf(fd: OwnedFd) -> bool {
     fn inner(fd: OwnedFd) -> io::Result<()> {
         Directory::try_from(fd)?.remove_all()
     }
-    inner(fd).map_or(false, |_| true)
+    inner(fd).is_ok()
 }
 
-pub(crate) fn map_file_for_cxx(path: &[u8], rw: bool) -> &'static mut [u8] {
-    unsafe {
-        map_file(Utf8CStr::from_bytes_unchecked(path), rw)
-            .log_cxx()
-            .unwrap_or(&mut [])
-    }
+pub(crate) fn map_file_for_cxx(path: &Utf8CStr, rw: bool) -> &'static mut [u8] {
+    map_file(path, rw).log_cxx().unwrap_or(&mut [])
 }
 
 pub(crate) fn map_fd_for_cxx(fd: RawFd, sz: usize, rw: bool) -> &'static mut [u8] {
@@ -66,3 +69,117 @@ pub(crate) fn map_fd_for_cxx(fd: RawFd, sz: usize, rw: bool) -> &'static mut [u8
             .unwrap_or(&mut [])
     }
 }
+
+pub(crate) unsafe fn readlinkat_for_cxx(
+    dirfd: RawFd,
+    path: *const c_char,
+    buf: *mut u8,
+    bufsz: usize,
+) -> isize {
+    // readlinkat() may fail on x86 platform, returning random value
+    // instead of number of bytes placed in buf (length of link)
+    cfg_if! {
+        if #[cfg(any(target_arch = "x86", target_arch = "x86_64"))] {
+            libc::memset(buf.cast(), 0, bufsz);
+            let mut r = libc::readlinkat(dirfd, path, buf.cast(), bufsz - 1);
+            if r > 0 {
+                r = libc::strlen(buf.cast()) as isize;
+            }
+        } else {
+            let r = libc::readlinkat(dirfd, path, buf.cast(), bufsz - 1);
+            if r >= 0 {
+                *buf.offset(r) = b'\0';
+            }
+        }
+    }
+    r
+}
+
+#[export_name = "cp_afc"]
+unsafe extern "C" fn cp_afc_for_cxx(src: *const c_char, dest: *const c_char) -> bool {
+    if let Ok(src) = Utf8CStr::from_ptr(src) {
+        if let Ok(dest) = Utf8CStr::from_ptr(dest) {
+            let src = FsPath::from(src);
+            let dest = FsPath::from(dest);
+            return src
+                .copy_to(dest)
+                .log_cxx_with_msg(|w| {
+                    w.write_fmt(format_args!("cp_afc {} -> {} failed", src, dest))
+                })
+                .is_ok();
+        }
+    }
+    false
+}
+
+#[export_name = "mv_path"]
+unsafe extern "C" fn mv_path_for_cxx(src: *const c_char, dest: *const c_char) -> bool {
+    if let Ok(src) = Utf8CStr::from_ptr(src) {
+        if let Ok(dest) = Utf8CStr::from_ptr(dest) {
+            let src = FsPath::from(src);
+            let dest = FsPath::from(dest);
+            return src
+                .move_to(dest)
+                .log_cxx_with_msg(|w| {
+                    w.write_fmt(format_args!("mv_path {} -> {} failed", src, dest))
+                })
+                .is_ok();
+        }
+    }
+    false
+}
+
+#[export_name = "link_path"]
+unsafe extern "C" fn link_path_for_cxx(src: *const c_char, dest: *const c_char) -> bool {
+    if let Ok(src) = Utf8CStr::from_ptr(src) {
+        if let Ok(dest) = Utf8CStr::from_ptr(dest) {
+            let src = FsPath::from(src);
+            let dest = FsPath::from(dest);
+            return src
+                .link_to(dest)
+                .log_cxx_with_msg(|w| {
+                    w.write_fmt(format_args!("link_path {} -> {} failed", src, dest))
+                })
+                .is_ok();
+        }
+    }
+    false
+}
+
+#[export_name = "clone_attr"]
+unsafe extern "C" fn clone_attr_for_cxx(src: *const c_char, dest: *const c_char) -> bool {
+    if let Ok(src) = Utf8CStr::from_ptr(src) {
+        if let Ok(dest) = Utf8CStr::from_ptr(dest) {
+            let src = FsPath::from(src);
+            let dest = FsPath::from(dest);
+            return clone_attr(src, dest)
+                .log_cxx_with_msg(|w| {
+                    w.write_fmt(format_args!("clone_attr {} -> {} failed", src, dest))
+                })
+                .is_ok();
+        }
+    }
+    false
+}
+
+#[export_name = "fclone_attr"]
+unsafe extern "C" fn fclone_attr_for_cxx(a: RawFd, b: RawFd) -> bool {
+    fclone_attr(a, b)
+        .log_cxx_with_msg(|w| w.write_str("fclone_attr failed"))
+        .is_ok()
+}
+
+#[export_name = "cxx$utf8str$new"]
+unsafe extern "C" fn str_new(this: &mut &Utf8CStr, s: *const u8, len: usize) {
+    *this = Utf8CStr::from_bytes(slice_from_ptr(s, len)).unwrap_or(cstr!(""));
+}
+
+#[export_name = "cxx$utf8str$ptr"]
+unsafe extern "C" fn str_ptr(this: &&Utf8CStr) -> *const u8 {
+    this.as_ptr().cast()
+}
+
+#[export_name = "cxx$utf8str$len"]
+unsafe extern "C" fn str_len(this: &&Utf8CStr) -> usize {
+    this.len()
+}

native/src/base/files.cpp

@@ -7,7 +7,6 @@
 #include <libgen.h>
 
 #include <base.hpp>
-#include <selinux.hpp>
 
 using namespace std;
 
@@ -20,191 +19,6 @@ int fd_pathat(int dirfd, const char *name, char *path, size_t size) {
     return 0;
 }
 
-void mv_path(const char *src, const char *dest) {
-    file_attr attr;
-    getattr(src, &attr);
-    if (S_ISDIR(attr.st.st_mode)) {
-        if (access(dest, F_OK) != 0) {
-            xmkdirs(dest, 0);
-            setattr(dest, &attr);
-        }
-        mv_dir(xopen(src, O_RDONLY | O_CLOEXEC), xopen(dest, O_RDONLY | O_CLOEXEC));
-    } else{
-        xrename(src, dest);
-    }
-    rmdir(src);
-}
-
-void mv_dir(int src, int dest) {
-    auto dir = xopen_dir(src);
-    run_finally f([=]{ close(dest); });
-    for (dirent *entry; (entry = xreaddir(dir.get()));) {
-        switch (entry->d_type) {
-        case DT_DIR:
-            if (xfaccessat(dest, entry->d_name, F_OK, 0) == 0) {
-                // Destination folder exists, needs recursive move
-                int newsrc = xopenat(src, entry->d_name, O_RDONLY | O_CLOEXEC);
-                int newdest = xopenat(dest, entry->d_name, O_RDONLY | O_CLOEXEC);
-                mv_dir(newsrc, newdest);
-                unlinkat(src, entry->d_name, AT_REMOVEDIR);
-                break;
-            }
-            // Else fall through
-        case DT_LNK:
-        case DT_REG:
-            renameat(src, entry->d_name, dest, entry->d_name);
-            break;
-        }
-    }
-}
-
-void cp_afc(const char *src, const char *dest) {
-    file_attr a;
-    getattr(src, &a);
-
-    if (S_ISDIR(a.st.st_mode)) {
-        xmkdirs(dest, 0);
-        clone_dir(xopen(src, O_RDONLY | O_CLOEXEC), xopen(dest, O_RDONLY | O_CLOEXEC));
-    } else{
-        unlink(dest);
-        if (S_ISREG(a.st.st_mode)) {
-            int sfd = xopen(src, O_RDONLY | O_CLOEXEC);
-            int dfd = xopen(dest, O_WRONLY | O_CREAT | O_TRUNC | O_CLOEXEC, 0);
-            xsendfile(dfd, sfd, nullptr, a.st.st_size);
-            close(sfd);
-            close(dfd);
-        } else if (S_ISLNK(a.st.st_mode)) {
-            char buf[4096];
-            xreadlink(src, buf, sizeof(buf));
-            xsymlink(buf, dest);
-        }
-    }
-    setattr(dest, &a);
-}
-
-void clone_dir(int src, int dest) {
-    auto dir = xopen_dir(src);
-    run_finally f([&]{ close(dest); });
-    for (dirent *entry; (entry = xreaddir(dir.get()));) {
-        file_attr a;
-        getattrat(src, entry->d_name, &a);
-        switch (entry->d_type) {
-            case DT_DIR: {
-                xmkdirat(dest, entry->d_name, 0);
-                setattrat(dest, entry->d_name, &a);
-                int sfd = xopenat(src, entry->d_name, O_RDONLY | O_CLOEXEC);
-                int dst = xopenat(dest, entry->d_name, O_RDONLY | O_CLOEXEC);
-                clone_dir(sfd, dst);
-                break;
-            }
-            case DT_REG: {
-                int sfd = xopenat(src, entry->d_name, O_RDONLY | O_CLOEXEC);
-                int dfd = xopenat(dest, entry->d_name, O_WRONLY | O_CREAT | O_TRUNC | O_CLOEXEC, 0);
-                xsendfile(dfd, sfd, nullptr, a.st.st_size);
-                fsetattr(dfd, &a);
-                close(dfd);
-                close(sfd);
-                break;
-            }
-            case DT_LNK: {
-                char buf[4096];
-                xreadlinkat(src, entry->d_name, buf, sizeof(buf));
-                xsymlinkat(buf, dest, entry->d_name);
-                setattrat(dest, entry->d_name, &a);
-                break;
-            }
-        }
-    }
-}
-
-void link_path(const char *src, const char *dest) {
-    link_dir(xopen(src, O_RDONLY | O_CLOEXEC), xopen(dest, O_RDONLY | O_CLOEXEC));
-}
-
-void link_dir(int src, int dest) {
-    auto dir = xopen_dir(src);
-    run_finally f([&]{ close(dest); });
-    for (dirent *entry; (entry = xreaddir(dir.get()));) {
-        if (entry->d_type == DT_DIR) {
-            file_attr a;
-            getattrat(src, entry->d_name, &a);
-            xmkdirat(dest, entry->d_name, 0);
-            setattrat(dest, entry->d_name, &a);
-            int sfd = xopenat(src, entry->d_name, O_RDONLY | O_CLOEXEC);
-            int dfd = xopenat(dest, entry->d_name, O_RDONLY | O_CLOEXEC);
-            link_dir(sfd, dfd);
-        } else {
-            xlinkat(src, entry->d_name, dest, entry->d_name, 0);
-        }
-    }
-}
-
-int getattr(const char *path, file_attr *a) {
-    if (xlstat(path, &a->st) == -1)
-        return -1;
-    char *con;
-    if (lgetfilecon(path, &con) == -1)
-        return -1;
-    strcpy(a->con, con);
-    freecon(con);
-    return 0;
-}
-
-int getattrat(int dirfd, const char *name, file_attr *a) {
-    char path[4096];
-    fd_pathat(dirfd, name, path, sizeof(path));
-    return getattr(path, a);
-}
-
-int fgetattr(int fd, file_attr *a) {
-    if (xfstat(fd, &a->st) < 0)
-        return -1;
-    char *con;
-    if (fgetfilecon(fd, &con) < 0)
-        return -1;
-    strcpy(a->con, con);
-    freecon(con);
-    return 0;
-}
-
-int setattr(const char *path, file_attr *a) {
-    if (chmod(path, a->st.st_mode & 0777) < 0)
-        return -1;
-    if (chown(path, a->st.st_uid, a->st.st_gid) < 0)
-        return -1;
-    if (a->con[0] && lsetfilecon(path, a->con) < 0)
-        return -1;
-    return 0;
-}
-
-int setattrat(int dirfd, const char *name, file_attr *a) {
-    char path[4096];
-    fd_pathat(dirfd, name, path, sizeof(path));
-    return setattr(path, a);
-}
-
-int fsetattr(int fd, file_attr *a) {
-    if (fchmod(fd, a->st.st_mode & 0777) < 0)
-        return -1;
-    if (fchown(fd, a->st.st_uid, a->st.st_gid) < 0)
-        return -1;
-    if (a->con[0] && fsetfilecon(fd, a->con) < 0)
-        return -1;
-    return 0;
-}
-
-void clone_attr(const char *src, const char *dest) {
-    file_attr a;
-    getattr(src, &a);
-    setattr(dest, &a);
-}
-
-void fclone_attr(int src, int dest) {
-    file_attr a;
-    fgetattr(src, &a);
-    fsetattr(dest, &a);
-}
-
 void full_read(int fd, string &str) {
     char buf[4096];
     for (ssize_t len; (len = xread(fd, buf, sizeof(buf))) > 0;)
@@ -375,7 +189,7 @@ sFILE make_file(FILE *fp) {
 }
 
 mmap_data::mmap_data(const char *name, bool rw) {
-    auto slice = rust::map_file(byte_view(name), rw);
+    auto slice = rust::map_file(name, rw);
     if (!slice.empty()) {
         _buf = slice.data();
         _sz = slice.size();

native/src/base/files.hpp

@@ -20,11 +20,6 @@ static inline T align_padding(T v, int a) {
     return align_to(v, a) - v;
 }
 
-struct file_attr {
-    struct stat st;
-    char con[128];
-};
-
 struct mount_info {
     unsigned int id;
     unsigned int parent;
@@ -58,27 +53,19 @@ int mkdirs(const char *path, mode_t mode);
 ssize_t canonical_path(const char * __restrict__ path, char * __restrict__ buf, size_t bufsiz);
 bool rm_rf(const char *path);
 bool frm_rf(int dirfd);
+void cp_afc(const char *src, const char *dest);
+void mv_path(const char *src, const char *dest);
+void link_path(const char *src, const char *dest);
+void clone_attr(const char *src, const char *dest);
+void fclone_attr(int src, int dest);
 
 } // extern "C"
 
 int fd_pathat(int dirfd, const char *name, char *path, size_t size);
-void mv_path(const char *src, const char *dest);
-void mv_dir(int src, int dest);
-void cp_afc(const char *src, const char *dest);
-void link_path(const char *src, const char *dest);
-void link_dir(int src, int dest);
 static inline ssize_t realpath(
         const char * __restrict__ path, char * __restrict__ buf, size_t bufsiz) {
     return canonical_path(path, buf, bufsiz);
 }
-int getattr(const char *path, file_attr *a);
-int getattrat(int dirfd, const char *name, file_attr *a);
-int fgetattr(int fd, file_attr *a);
-int setattr(const char *path, file_attr *a);
-int setattrat(int dirfd, const char *name, file_attr *a);
-int fsetattr(int fd, file_attr *a);
-void fclone_attr(int src, int dest);
-void clone_attr(const char *src, const char *dest);
 void full_read(int fd, std::string &str);
 void full_read(const char *filename, std::string &str);
 std::string full_read(int fd);
@@ -90,7 +77,6 @@ void file_readline(const char *file, const std::function<bool(std::string_view)>
 void parse_prop_file(FILE *fp, const std::function<bool(std::string_view, std::string_view)> &fn);
 void parse_prop_file(const char *file,
         const std::function<bool(std::string_view, std::string_view)> &fn);
-void clone_dir(int src, int dest);
 std::vector<mount_info> parse_mount_info(const char *pid);
 std::string resolve_preinit_dir(const char *base_dir);
 

native/src/base/files.rs

@@ -10,9 +10,18 @@ use std::os::unix::fs::FileTypeExt;
 use std::os::unix::io::{AsRawFd, FromRawFd, OwnedFd, RawFd};
 use std::{io, mem, ptr, slice};
 
-use libc::{c_char, c_uint, dirent, mode_t, EEXIST, ENOENT, O_CLOEXEC, O_PATH, O_RDONLY, O_RDWR};
+use bytemuck::{bytes_of_mut, Pod};
+use libc::{
+    c_uint, dirent, mode_t, EEXIST, ENOENT, F_OK, O_CLOEXEC, O_CREAT, O_PATH, O_RDONLY, O_RDWR,
+    O_TRUNC, O_WRONLY, S_IFDIR, S_IFLNK, S_IFREG,
+};
+use num_traits::AsPrimitive;
 
-use crate::{bfmt_cstr, copy_cstr, cstr, errno, error, FlatData, LibcReturn, Utf8CStr};
+use crate::cxx_extern::readlinkat_for_cxx;
+use crate::{
+    copy_cstr, cstr, errno, error, FsPath, FsPathBuf, LibcReturn, Utf8CStr, Utf8CStrBuf,
+    Utf8CStrBufArr,
+};
 
 pub fn __open_fd_impl(path: &Utf8CStr, flags: i32, mode: mode_t) -> io::Result<OwnedFd> {
     unsafe {
@@ -31,77 +40,15 @@ macro_rules! open_fd {
     };
 }
 
-pub(crate) unsafe fn readlink_unsafe(path: *const c_char, buf: *mut u8, bufsz: usize) -> isize {
-    let r = libc::readlink(path, buf.cast(), bufsz - 1);
-    if r >= 0 {
-        *buf.offset(r) = b'\0';
-    }
-    r
-}
-
-pub fn readlink(path: &Utf8CStr, data: &mut [u8]) -> io::Result<usize> {
-    let r =
-        unsafe { readlink_unsafe(path.as_ptr(), data.as_mut_ptr(), data.len()) }.check_os_err()?;
-    Ok(r as usize)
-}
-
-pub fn fd_path(fd: RawFd, buf: &mut [u8]) -> io::Result<usize> {
-    let mut fd_buf = [0_u8; 40];
-    let fd_path = bfmt_cstr!(&mut fd_buf, "/proc/self/fd/{}", fd);
-    readlink(fd_path, buf)
-}
-
-// Inspired by https://android.googlesource.com/platform/bionic/+/master/libc/bionic/realpath.cpp
-pub fn realpath(path: &Utf8CStr, buf: &mut [u8]) -> io::Result<usize> {
-    let fd = open_fd!(path, O_PATH | O_CLOEXEC)?;
-    let mut st1: libc::stat;
-    let mut st2: libc::stat;
-    let mut skip_check = false;
-    unsafe {
-        st1 = mem::zeroed();
-        if libc::fstat(fd.as_raw_fd(), &mut st1) < 0 {
-            // This shall only fail on Linux < 3.6
-            skip_check = true;
-        }
-    }
-    let len = fd_path(fd.as_raw_fd(), buf)?;
-    unsafe {
-        st2 = mem::zeroed();
-        if libc::stat(buf.as_ptr().cast(), &mut st2) < 0
-            || (!skip_check && (st2.st_dev != st1.st_dev || st2.st_ino != st1.st_ino))
-        {
-            *errno() = ENOENT;
-            return Err(io::Error::last_os_error());
-        }
-    }
-    Ok(len)
-}
-
-pub fn mkdirs(path: &Utf8CStr, mode: mode_t) -> io::Result<()> {
-    let mut buf = [0_u8; 4096];
-    let len = copy_cstr(&mut buf, path);
-    let buf = &mut buf[..len];
-    let mut off = 1;
-    unsafe {
-        while let Some(p) = buf[off..].iter().position(|c| *c == b'/') {
-            buf[off + p] = b'\0';
-            if libc::mkdir(buf.as_ptr().cast(), mode) < 0 && *errno() != EEXIST {
-                return Err(io::Error::last_os_error());
-            }
-            buf[off + p] = b'/';
-            off += p + 1;
-        }
-        if libc::mkdir(buf.as_ptr().cast(), mode) < 0 && *errno() != EEXIST {
-            return Err(io::Error::last_os_error());
-        }
-    }
-    *errno() = 0;
-    Ok(())
+pub fn fd_path(fd: RawFd, buf: &mut dyn Utf8CStrBuf) -> io::Result<()> {
+    let mut arr = Utf8CStrBufArr::<40>::new();
+    let path = FsPathBuf::new(&mut arr).join("/proc/self/fd").join_fmt(fd);
+    path.read_link(buf)
 }
 
 pub trait ReadExt {
     fn skip(&mut self, len: usize) -> io::Result<()>;
-    fn read_flat_data<F: FlatData>(&mut self, data: &mut F) -> io::Result<()>;
+    fn read_pod<F: Pod>(&mut self, data: &mut F) -> io::Result<()>;
 }
 
 impl<T: Read> ReadExt for T {
@@ -116,8 +63,8 @@ impl<T: Read> ReadExt for T {
         Ok(())
     }
 
-    fn read_flat_data<F: FlatData>(&mut self, data: &mut F) -> io::Result<()> {
-        self.read_exact(data.as_raw_bytes_mut())
+    fn read_pod<F: Pod>(&mut self, data: &mut F) -> io::Result<()> {
+        self.read_exact(bytes_of_mut(data))
     }
 }
 
@@ -190,6 +137,25 @@ impl<T: Write> WriteExt for T {
     }
 }
 
+pub struct FileAttr {
+    pub st: libc::stat,
+    #[cfg(feature = "selinux")]
+    pub con: Utf8CStrBufArr<128>,
+}
+
+impl FileAttr {
+    fn new() -> Self {
+        FileAttr {
+            st: unsafe { mem::zeroed() },
+            #[cfg(feature = "selinux")]
+            con: Utf8CStrBufArr::new(),
+        }
+    }
+}
+
+#[cfg(feature = "selinux")]
+const XATTR_NAME_SELINUX: &[u8] = b"security.selinux\0";
+
 pub struct DirEntry<'a> {
     dir: &'a Directory,
     entry: &'a dirent,
@@ -206,12 +172,11 @@ impl DirEntry<'_> {
         }
     }
 
-    pub fn path(&self, buf: &mut [u8]) -> io::Result<usize> {
-        let mut len = self.dir.path(buf)?;
-        buf[len] = b'/';
-        len += 1;
-        len += copy_cstr(&mut buf[len..], self.d_name());
-        Ok(len)
+    pub fn path(&self, buf: &mut dyn Utf8CStrBuf) -> io::Result<()> {
+        self.dir.path(buf)?;
+        buf.push_str("/");
+        buf.push_lossy(self.d_name().to_bytes());
+        Ok(())
     }
 
     pub fn is_dir(&self) -> bool {
@@ -234,34 +199,49 @@ impl DirEntry<'_> {
         Ok(())
     }
 
+    pub fn read_link(&self, buf: &mut dyn Utf8CStrBuf) -> io::Result<()> {
+        buf.clear();
+        unsafe {
+            let r = readlinkat_for_cxx(
+                self.dir.as_raw_fd(),
+                self.d_name.as_ptr(),
+                buf.as_mut_ptr().cast(),
+                buf.capacity(),
+            )
+            .check_os_err()? as usize;
+            buf.set_len(r);
+        }
+        Ok(())
+    }
+
+    unsafe fn open_fd(&self, flags: i32) -> io::Result<RawFd> {
+        self.dir.open_fd(self.d_name(), flags, 0)
+    }
+
     pub fn open_as_dir(&self) -> io::Result<Directory> {
         if !self.is_dir() {
             return Err(io::Error::from(io::ErrorKind::NotADirectory));
         }
-        unsafe {
-            let fd = libc::openat(
-                self.dir.as_raw_fd(),
-                self.d_name.as_ptr(),
-                O_RDONLY | O_CLOEXEC,
-            )
-            .check_os_err()?;
-            Directory::try_from(OwnedFd::from_raw_fd(fd))
-        }
+        unsafe { Directory::try_from(OwnedFd::from_raw_fd(self.open_fd(O_RDONLY)?)) }
     }
 
     pub fn open_as_file(&self, flags: i32) -> io::Result<File> {
         if self.is_dir() {
             return Err(io::Error::from(io::ErrorKind::IsADirectory));
         }
-        unsafe {
-            let fd = libc::openat(
-                self.dir.as_raw_fd(),
-                self.d_name.as_ptr(),
-                flags | O_CLOEXEC,
-            )
-            .check_os_err()?;
-            Ok(File::from_raw_fd(fd))
-        }
+        unsafe { Ok(File::from_raw_fd(self.open_fd(flags)?)) }
+    }
+
+    pub fn get_attr(&self) -> io::Result<FileAttr> {
+        let mut path = Utf8CStrBufArr::default();
+        self.path(&mut path)?;
+        FsPath::from(&path).get_attr()
+    }
+
+    pub fn set_attr(&self, attr: &FileAttr) -> io::Result<()> {
+        let mut path = Utf8CStrBufArr::default();
+        self.path(&mut path)?;
+        FsPath::from(&path).set_attr(attr)
     }
 }
 
@@ -320,7 +300,26 @@ impl Directory {
         unsafe { libc::rewinddir(self.dirp) }
     }
 
-    pub fn path(&self, buf: &mut [u8]) -> io::Result<usize> {
+    unsafe fn open_fd(&self, name: &CStr, flags: i32, mode: i32) -> io::Result<RawFd> {
+        libc::openat(self.as_raw_fd(), name.as_ptr(), flags | O_CLOEXEC, mode).check_os_err()
+    }
+
+    pub fn contains_path(&self, path: &CStr) -> bool {
+        // WARNING: Using faccessat is incorrect, because the raw linux kernel syscall
+        // does not support the flag AT_SYMLINK_NOFOLLOW until 5.8 with faccessat2.
+        // Use fstatat to check the existence of a file instead.
+        unsafe {
+            let mut st: libc::stat = mem::zeroed();
+            libc::fstatat(
+                self.as_raw_fd(),
+                path.as_ptr(),
+                &mut st,
+                libc::AT_SYMLINK_NOFOLLOW,
+            ) == 0
+        }
+    }
+
+    pub fn path(&self, buf: &mut dyn Utf8CStrBuf) -> io::Result<()> {
         fd_path(self.as_raw_fd(), buf)
     }
 
@@ -345,6 +344,108 @@ impl Directory {
         })?;
         Ok(())
     }
+
+    pub fn copy_into(&mut self, dir: &Directory) -> io::Result<()> {
+        while let Some(ref e) = self.read()? {
+            let attr = e.get_attr()?;
+            let new_entry = DirEntry {
+                dir,
+                entry: e.entry,
+                d_name_len: e.d_name_len,
+            };
+            if e.is_dir() {
+                unsafe {
+                    libc::mkdirat(dir.as_raw_fd(), e.d_name.as_ptr(), 0o777).as_os_err()?;
+                }
+                let mut src = e.open_as_dir()?;
+                let dest = new_entry.open_as_dir()?;
+                src.copy_into(&dest)?;
+                fd_set_attr(dest.as_raw_fd(), &attr)?;
+            } else if e.is_file() {
+                let mut src = e.open_as_file(O_RDONLY)?;
+                let mut dest = unsafe {
+                    File::from_raw_fd(dir.open_fd(
+                        e.d_name(),
+                        O_WRONLY | O_CREAT | O_TRUNC,
+                        0o777,
+                    )?)
+                };
+                std::io::copy(&mut src, &mut dest)?;
+                fd_set_attr(dest.as_raw_fd(), &attr)?;
+            } else if e.is_lnk() {
+                let mut path = Utf8CStrBufArr::default();
+                e.read_link(&mut path)?;
+                unsafe {
+                    libc::symlinkat(path.as_ptr(), dir.as_raw_fd(), e.d_name.as_ptr())
+                        .as_os_err()?;
+                }
+                new_entry.set_attr(&attr)?;
+            }
+        }
+        Ok(())
+    }
+
+    pub fn move_into(&mut self, dir: &Directory) -> io::Result<()> {
+        let dir_fd = self.as_raw_fd();
+        while let Some(ref e) = self.read()? {
+            if e.is_dir() && dir.contains_path(e.d_name()) {
+                // Destination folder exists, needs recursive move
+                let mut src = e.open_as_dir()?;
+                let new_entry = DirEntry {
+                    dir,
+                    entry: e.entry,
+                    d_name_len: e.d_name_len,
+                };
+                let dest = new_entry.open_as_dir()?;
+                src.move_into(&dest)?;
+                return e.unlink();
+            }
+
+            unsafe {
+                libc::renameat(
+                    dir_fd,
+                    e.d_name.as_ptr(),
+                    dir.as_raw_fd(),
+                    e.d_name.as_ptr(),
+                )
+                .as_os_err()?;
+            }
+        }
+        Ok(())
+    }
+
+    pub fn link_into(&mut self, dir: &Directory) -> io::Result<()> {
+        let dir_fd = self.as_raw_fd();
+        while let Some(ref e) = self.read()? {
+            if e.is_dir() {
+                unsafe {
+                    libc::mkdirat(dir.as_raw_fd(), e.d_name.as_ptr(), 0o777).as_os_err()?;
+                }
+                let attr = e.get_attr()?;
+                let new_entry = DirEntry {
+                    dir,
+                    entry: e.entry,
+                    d_name_len: e.d_name_len,
+                };
+                let mut src = e.open_as_dir()?;
+                let dest = new_entry.open_as_dir()?;
+                src.link_into(&dest)?;
+                fd_set_attr(dest.as_raw_fd(), &attr)?;
+            } else {
+                unsafe {
+                    libc::linkat(
+                        dir_fd,
+                        e.d_name.as_ptr(),
+                        dir.as_raw_fd(),
+                        e.d_name.as_ptr(),
+                        0,
+                    )
+                    .as_os_err()?;
+                }
+            }
+        }
+        Ok(())
+    }
 }
 
 impl Directory {
@@ -427,19 +528,254 @@ impl Drop for Directory {
     }
 }
 
-pub fn rm_rf(path: &Utf8CStr) -> io::Result<()> {
-    unsafe {
-        let f = File::from(open_fd!(path, O_RDONLY | O_CLOEXEC)?);
+impl FsPath {
+    pub fn open(&self, flags: i32) -> io::Result<File> {
+        Ok(File::from(open_fd!(self, flags)?))
+    }
+
+    pub fn create(&self, flags: i32, mode: mode_t) -> io::Result<File> {
+        Ok(File::from(open_fd!(self, flags, mode)?))
+    }
+
+    pub fn exists(&self) -> bool {
+        unsafe { libc::access(self.as_ptr(), F_OK) == 0 }
+    }
+
+    pub fn rename_to<T: AsRef<Utf8CStr>>(&self, name: T) -> io::Result<()> {
+        unsafe { libc::rename(self.as_ptr(), name.as_ref().as_ptr()).as_os_err() }
+    }
+
+    pub fn remove(&self) -> io::Result<()> {
+        unsafe { libc::remove(self.as_ptr()).as_os_err() }
+    }
+
+    pub fn remove_all(&self) -> io::Result<()> {
+        let f = self.open(O_RDONLY | O_CLOEXEC)?;
         let st = f.metadata()?;
         if st.is_dir() {
             let mut dir = Directory::try_from(OwnedFd::from(f))?;
             dir.remove_all()?;
         }
-        libc::remove(path.as_ptr()).check_os_err()?;
+        self.remove()
+    }
+
+    pub fn read_link(&self, buf: &mut dyn Utf8CStrBuf) -> io::Result<()> {
+        buf.clear();
+        unsafe {
+            let r = libc::readlink(self.as_ptr(), buf.as_mut_ptr().cast(), buf.capacity() - 1)
+                .check_os_err()? as usize;
+            *buf.mut_buf().get_unchecked_mut(r) = b'\0';
+            buf.set_len(r);
+        }
+        Ok(())
+    }
+
+    pub fn mkdir(&self, mode: mode_t) -> io::Result<()> {
+        unsafe {
+            if libc::mkdir(self.as_ptr(), mode) < 0 {
+                if *errno() == EEXIST {
+                    libc::chmod(self.as_ptr(), mode).as_os_err()?;
+                } else {
+                    return Err(io::Error::last_os_error());
+                }
+            }
+        }
+        Ok(())
+    }
+
+    pub fn mkdirs(&self, mode: mode_t) -> io::Result<()> {
+        let mut buf = [0_u8; 4096];
+        let len = copy_cstr(&mut buf, self);
+        let buf = &mut buf[..len];
+        let mut off = 1;
+        unsafe {
+            while let Some(p) = buf[off..].iter().position(|c| *c == b'/') {
+                buf[off + p] = b'\0';
+                if libc::mkdir(buf.as_ptr().cast(), mode) < 0 && *errno() != EEXIST {
+                    return Err(io::Error::last_os_error());
+                }
+                buf[off + p] = b'/';
+                off += p + 1;
+            }
+            if libc::mkdir(buf.as_ptr().cast(), mode) < 0 && *errno() != EEXIST {
+                return Err(io::Error::last_os_error());
+            }
+        }
+        *errno() = 0;
+        Ok(())
+    }
+
+    // Inspired by https://android.googlesource.com/platform/bionic/+/master/libc/bionic/realpath.cpp
+    pub fn realpath(&self, buf: &mut dyn Utf8CStrBuf) -> io::Result<()> {
+        let fd = open_fd!(self, O_PATH | O_CLOEXEC)?;
+        let mut st1: libc::stat;
+        let mut st2: libc::stat;
+        let mut skip_check = false;
+        unsafe {
+            st1 = mem::zeroed();
+            if libc::fstat(fd.as_raw_fd(), &mut st1) < 0 {
+                // This will only fail on Linux < 3.6
+                skip_check = true;
+            }
+        }
+        fd_path(fd.as_raw_fd(), buf)?;
+        unsafe {
+            st2 = mem::zeroed();
+            libc::stat(buf.as_ptr(), &mut st2).as_os_err()?;
+            if !skip_check && (st2.st_dev != st1.st_dev || st2.st_ino != st1.st_ino) {
+                *errno() = ENOENT;
+                return Err(io::Error::last_os_error());
+            }
+        }
+        Ok(())
+    }
+
+    pub fn get_attr(&self) -> io::Result<FileAttr> {
+        let mut attr = FileAttr::new();
+        unsafe {
+            libc::lstat(self.as_ptr(), &mut attr.st).as_os_err()?;
+
+            #[cfg(feature = "selinux")]
+            {
+                let sz = libc::lgetxattr(
+                    self.as_ptr(),
+                    XATTR_NAME_SELINUX.as_ptr().cast(),
+                    attr.con.as_mut_ptr().cast(),
+                    attr.con.capacity(),
+                )
+                .check_os_err()?;
+                attr.con.set_len((sz - 1) as usize);
+            }
+        }
+        Ok(attr)
+    }
+
+    pub fn set_attr(&self, attr: &FileAttr) -> io::Result<()> {
+        unsafe {
+            if (attr.st.st_mode & libc::S_IFMT as c_uint) != S_IFLNK.as_() {
+                libc::chmod(self.as_ptr(), (attr.st.st_mode & 0o777).as_()).as_os_err()?;
+            }
+            libc::lchown(self.as_ptr(), attr.st.st_uid, attr.st.st_gid).as_os_err()?;
+
+            #[cfg(feature = "selinux")]
+            if !attr.con.is_empty() {
+                libc::lsetxattr(
+                    self.as_ptr(),
+                    XATTR_NAME_SELINUX.as_ptr().cast(),
+                    attr.con.as_ptr().cast(),
+                    attr.con.len() + 1,
+                    0,
+                )
+                .as_os_err()?;
+            }
+        }
+        Ok(())
+    }
+
+    pub fn copy_to(&self, path: &FsPath) -> io::Result<()> {
+        let attr = self.get_attr()?;
+        if (attr.st.st_mode & libc::S_IFMT as c_uint) == S_IFDIR.as_() {
+            path.mkdir(0o777)?;
+            let mut src = Directory::open(self)?;
+            let dest = Directory::open(path)?;
+            src.copy_into(&dest)?;
+        } else {
+            // It's OK if remove failed
+            path.remove().ok();
+            if (attr.st.st_mode & libc::S_IFMT as c_uint) == S_IFREG.as_() {
+                let mut src = self.open(O_RDONLY | O_CLOEXEC)?;
+                let mut dest = path.create(O_WRONLY | O_CREAT | O_TRUNC | O_CLOEXEC, 0o777)?;
+                std::io::copy(&mut src, &mut dest)?;
+            } else if (attr.st.st_mode & libc::S_IFMT as c_uint) == S_IFLNK.as_() {
+                let mut buf = Utf8CStrBufArr::default();
+                self.read_link(&mut buf)?;
+                unsafe {
+                    libc::symlink(buf.as_ptr(), path.as_ptr()).as_os_err()?;
+                }
+            }
+        }
+        path.set_attr(&attr)?;
+        Ok(())
+    }
+
+    pub fn move_to(&self, path: &FsPath) -> io::Result<()> {
+        if path.exists() {
+            let attr = path.get_attr()?;
+            if (attr.st.st_mode & libc::S_IFMT as c_uint) == S_IFDIR.as_() {
+                let mut src = Directory::open(self)?;
+                let dest = Directory::open(path)?;
+                return src.move_into(&dest);
+            } else {
+                path.remove()?;
+            }
+        }
+        self.rename_to(path)
+    }
+
+    pub fn link_to(&self, path: &FsPath) -> io::Result<()> {
+        let attr = self.get_attr()?;
+        if (attr.st.st_mode & libc::S_IFMT as c_uint) == S_IFDIR.as_() {
+            path.mkdir(0o777)?;
+            path.set_attr(&attr)?;
+            let mut src = Directory::open(self)?;
+            let dest = Directory::open(path)?;
+            src.link_into(&dest)
+        } else {
+            unsafe { libc::link(self.as_ptr(), path.as_ptr()).as_os_err() }
+        }
+    }
+}
+
+pub fn fd_get_attr(fd: RawFd) -> io::Result<FileAttr> {
+    let mut attr = FileAttr::new();
+    unsafe {
+        libc::fstat(fd, &mut attr.st).as_os_err()?;
+
+        #[cfg(feature = "selinux")]
+        {
+            let sz = libc::fgetxattr(
+                fd,
+                XATTR_NAME_SELINUX.as_ptr().cast(),
+                attr.con.as_mut_ptr().cast(),
+                attr.con.capacity(),
+            )
+            .check_os_err()?;
+            attr.con.set_len((sz - 1) as usize);
+        }
+    }
+    Ok(attr)
+}
+
+pub fn fd_set_attr(fd: RawFd, attr: &FileAttr) -> io::Result<()> {
+    unsafe {
+        libc::fchmod(fd, (attr.st.st_mode & 0o777).as_()).as_os_err()?;
+        libc::fchown(fd, attr.st.st_uid, attr.st.st_gid).as_os_err()?;
+
+        #[cfg(feature = "selinux")]
+        if !attr.con.is_empty() {
+            libc::fsetxattr(
+                fd,
+                XATTR_NAME_SELINUX.as_ptr().cast(),
+                attr.con.as_ptr().cast(),
+                attr.con.len() + 1,
+                0,
+            )
+            .as_os_err()?;
+        }
     }
     Ok(())
 }
 
+pub fn clone_attr(a: &FsPath, b: &FsPath) -> io::Result<()> {
+    let attr = a.get_attr()?;
+    b.set_attr(&attr)
+}
+
+pub fn fclone_attr(a: RawFd, b: RawFd) -> io::Result<()> {
+    let attr = fd_get_attr(a)?;
+    fd_set_attr(b, &attr)
+}
+
 pub struct MappedFile(&'static mut [u8]);
 
 impl MappedFile {
@@ -476,13 +812,13 @@ impl Drop for MappedFile {
     }
 }
 
+extern "C" {
+    // Don't use the declaration from the libc crate as request should be u32 not i32
+    fn ioctl(fd: RawFd, request: u32, ...) -> i32;
+}
+
 // We mark the returned slice static because it is valid until explicitly unmapped
 pub(crate) fn map_file(path: &Utf8CStr, rw: bool) -> io::Result<&'static mut [u8]> {
-    extern "C" {
-        // Don't use the declaration from the libc crate as request should be u32 not i32
-        fn ioctl(fd: RawFd, request: u32, ...) -> i32;
-    }
-
     #[cfg(target_pointer_width = "64")]
     const BLKGETSIZE64: u32 = 0x80081272;
 
@@ -495,7 +831,7 @@ pub(crate) fn map_file(path: &Utf8CStr, rw: bool) -> io::Result<&'static mut [u8
     let st = f.metadata()?;
     let sz = if st.file_type().is_block_device() {
         let mut sz = 0_u64;
-        unsafe { ioctl(f.as_raw_fd(), BLKGETSIZE64, &mut sz) }.check_os_err()?;
+        unsafe { ioctl(f.as_raw_fd(), BLKGETSIZE64, &mut sz) }.as_os_err()?;
         sz
     } else {
         st.st_size()