Skip to content

nomount: implement whiteouts, hijacking hooks and refactor code - #23

Open
maxsteeel wants to merge 65 commits into
masterfrom
dev
Open

nomount: implement whiteouts, hijacking hooks and refactor code#23
maxsteeel wants to merge 65 commits into
masterfrom
dev

Conversation

@maxsteeel

@maxsteeel maxsteeel commented Jul 2, 2026

Copy link
Copy Markdown
Owner
  • kernel/:

    • Implement the NM_FLAG_WHITEOUT bitmask to explicitly hide existing physical files from the VFS.
    • Replace all in-kernel hooks in favor of hijacking of i_op / f_op / s_op structures of files.
    • Replace hashtable lookups for structure hijacking lookups for O(1) lookups in hot-paths.
    • Remove nomount_inodes_ht and nomount_inode_node. Added nm_inode_info to O(1) inode operations.
    • Fix a critical logic error by replacing bitwise masking switch statements with sequential if conditions in inode spoofing routines.
    • Replace directory child arrays to directory child IDR trees, to improve management of directory childs and also to optimize iterate_dir operations.
    • Replace UID exclusion lists/hashtables to a IDR tree for O(1) checks.
    • Add missing u8 flags member to struct nomount_child_name to allow flag inheritance.
    • Simplifying and removing dead code.
  • userspace/:

    • Extend Netlink payload struct to pack NM_FLAG_WHITEOUT instructions via the new w (whiteout) command argument in the nm CLI tool.
    • Adapt the JSON and raw nm list parsers to properly identify and print whiteout entries natively from the Netlink attribute header.
    • Implement UID-based operations. Now can add, o hide files / folders for some UID's
      • Example:
      • nm add /system/etc/hosts /data/adb/modules/hosts/system/etc/hosts --uid 10100
      • nm whiteout /system/etc/lineage.prop --uid 10240
    • Replace .bss buffers for a stack-based buffers, to avoid strange bugs in some devices when .bss is ignored.
    • Solved some little bugs.
  • module/:

    • Add support for traditional OverlayFS character device (mknod) and Magisk .replace syntax detection during the boot phase inside metamount.sh. In response of [Question] Delete implementation method in NoMount #16
    • Refactor xargs batching pipelines in metamount.sh and index.js to process up to the maximum ARG_MAX limit dynamically via null-byte (\0) streams.
    • Remove JSON parsing overhead from hot-unloading routines in the WebUI, opting for a direct unified file/symlink/char device file-system scan targeting nm d.
    • Implement UID exclusion list directly from kernel, to verify what's UID's are really blocked in kernel.
    • Remove the alias engine.

@maxsteeel
maxsteeel marked this pull request as ready for review July 5, 2026 04:48
@maxsteeel
maxsteeel force-pushed the dev branch 2 times, most recently from a40e9bc to f453d10 Compare July 5, 2026 05:34
@maxsteeel
maxsteeel marked this pull request as draft July 12, 2026 21:14
@maxsteeel
maxsteeel marked this pull request as ready for review July 24, 2026 23:18
maxsteeel added 24 commits July 25, 2026 18:24
- kernel/:
  - Implement the `NM_FLAG_WHITEOUT` bitmask to explicitly hide existing physical files from the VFS.
  - Intercept `iterate_dir` via `nomount_actor_proxy` to silently drop `dir_context` entries flagged with `NM_FLAG_WHITEOUT`.
  - Strip trailing slashes and handle whiteouts safely in-place within `nomount_handle_getname`.
  - Refactor private dirs logic from path-based string matching to pure inode/dentry tracking.
  - Unify multiple RCU read lock sections and sequential hash table lookups into a single O(1) pass within `nomount_handle_getattr` and `nomount_handle_permission` to reduce CPU cache thrashing and lock contention.
  - Fix a critical logic error by replacing bitwise masking `switch` statements with sequential `if` conditions in inode spoofing routines.
  - Add missing `u8 flags` member to `struct nomount_child_name` to allow flag inheritance in the virtual topology array.
  - Remove `__nomount_is_injected_file_rcu` and `__nomount_is_traversal_allowed_rcu` helpers.

- userspace/:
  - Extend Netlink payload struct to pack `NM_FLAG_WHITEOUT` instructions via the new `w` command argument in the `nm` CLI tool.
  - Adapt the JSON and raw `nm list` parsers to properly identify and print whiteout entries natively from the Netlink attribute header.

- module/:
  - Add support for traditional OverlayFS character device (`mknod`) and Magisk `.replace` syntax detection during the boot phase inside `metamount.sh`.
  - Refactor `xargs` batching pipelines in `metamount.sh` and `index.js` to process up to the maximum `ARG_MAX` limit dynamically via null-byte (`\0`) streams.
  - Remove JSON parsing overhead from hot-unloading routines in the WebUI, opting for a direct unified file/symlink/char device file-system scan targeting `nm d`.
- Switched to Flexible Array Members (FAM) to eliminate SLUB overhead.
- Removed compiler padding and redundant struct list_heads.
- Implemented an 8KB static u8 counting filter for lockless getname rejection.
- Optimized Netlink batch routing to use direct memory access without copy.
- Improved iterate_dir proxy by replacing strlen with boundary checks.

Dramatically reduces unpageable memory usage and VFS latency overhead.
Bouteillepleine and others added 5 commits July 27, 2026 20:04
TODO: implement correct cleanup of hijacked structures in nomount_clear_all when is_exit = true to avoid UAF in nomount_exit
Co-authored-by: Max <109047395+maxsteeel@users.noreply.github.com>
these functions are a experiment, to see the posibilities of injection in nomount, but these functions are not useful in Android, so is better remove it
@maxsteeel
maxsteeel force-pushed the dev branch 2 times, most recently from 08f1e9c to a29e687 Compare July 30, 2026 22:41
@maxsteeel
maxsteeel force-pushed the dev branch 2 times, most recently from bd69286 to 3cd828a Compare July 31, 2026 04:39
@maxsteeel
maxsteeel force-pushed the dev branch 3 times, most recently from 65034ff to 0a054d7 Compare August 3, 2026 01:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants