aviraxp · Sep 4, 2026 · Aug 28, 2026 · Aug 30, 2026 · Aug 30, 2026 · Sep 1, 2026
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -21,15 +21,41 @@ jobs:
         run: |
           mkdir -p ksud
           for dir in ./ksud-*; do
-              if [ -d "$dir" ]; then
-                 echo "----- Rename $dir -----"
-                 ksud_platform_name=$(basename "$dir")
-                 find "$dir" -type f -name "ksud" -path "*/release/*" | while read -r ksud_file; do
-                   if [ -f "$ksud_file" ]; then
-                     mv "$ksud_file" "ksud/$ksud_platform_name"
-                   fi
-                 done
-              fi
+            if [ -d "$dir" ]; then
+                echo "----- Rename $dir -----"
+                ksud_platform_name=$(basename "$dir")
+                if [ -f "$dir/ksud" ]; then
+                  mv "$dir/ksud" "ksud/$ksud_platform_name"
+                elif [ -f "$dir/ksud.exe" ]; then
+                  mv "$dir/ksud.exe" "ksud/$ksud_platform_name.exe"
+                fi
+            fi
+          done
+
+      - name: Rename ksuinit
+        run: |
+          mkdir -p ksuinit
+          for dir in ./ksuinit-*; do
+            if [ -d "$dir" ]; then
+                echo "----- Rename $dir -----"
+                ksuinit_platform_name=$(basename "$dir")
+                if [ -f "$dir/ksuinit" ]; then
+                  mv "$dir/ksuinit" "ksuinit/$ksuinit_platform_name"
+                fi
+            fi
+          done
+
+      - name: Rename lkm
+        run: |
+          mkdir -p lkm
+          for dir in ./*-android*-lkm; do
+            if [ -d "$dir" ]; then
+                echo "----- Rename $dir -----"
+                lkm_platform_name=$(basename "$dir")
+                lkm_platform_name="lkm-${lkm_platform_name%-lkm}_kernelsu.ko"
+                KO="$(ls $dir/*_kernelsu.ko)"
+                mv "$KO" "lkm/$lkm_platform_name"
+            fi
           done
 
       - name: Display structure of downloaded files
@@ -40,6 +66,6 @@ jobs:
         with:
           files: |
             manager/*.apk
-            android*-lkm/*_kernelsu.ko
+            lkm/lkm-*_kernelsu.ko
             ksud/ksud-*
-            ksuinit/**
+            ksuinit/*
diff --git a/docs/README_ID.md b/docs/README_ID.md
@@ -4,7 +4,7 @@
 
 <img src="https://kernelsu.org/logo.png" style="width: 96px;" alt="logo">
 
-Solusi root berbasis Kernel untuk perangkat Android.
+Solusi root berbasis kernel untuk perangkat Android.
 
 [![Latest release](https://img.shields.io/github/v/release/tiann/KernelSU?label=Release&logo=github)](https://github.com/tiann/KernelSU/releases/latest)
 [![Weblate](https://img.shields.io/badge/Localization-Weblate-teal?logo=weblate)](https://hosted.weblate.org/engage/kernelsu)
@@ -14,43 +14,49 @@ Solusi root berbasis Kernel untuk perangkat Android.
 
 ## Fitur
 
-1. Manajemen akses root dan `su` berbasis kernel.
-2. Sistem modul berdasarkan [metamodules](https://kernelsu.org/id_ID/guide/metamodule.html): Infrastruktur pluggable untuk modifikasi systemless.
-3. [Profil Aplikasi](https://kernelsu.org/guide/app-profile.html): Kunci daya root di dalam sangkar.
+1. Akses `su` dan manajemen hak akses root berbasis kernel.
+2. Sistem modul berbasis [metamodules](https://kernelsu.org/id_ID/guide/metamodule.html): Infrastruktur yang dapat dicopot-pasang untuk modifikasi systemless.
+3. [Profil Aplikasi](https://kernelsu.org/guide/app-profile.html): Kendalikan hak akses root secara aman.
 
 ## Status Kompatibilitas
 
-KernelSU secara resmi mendukung perangkat Android GKI 2.0 (dengan kernel 5.10+), kernel lama (4.14+) juga kompatibel, tetapi Anda perlu membuat kernel sendiri.
+KernelSU secara resmi mendukung perangkat Android GKI 2.0 (dengan kernel 5.10+), kernel lama (4.14+) juga didukung, tetapi kernel perlu dikompilasi secara manual.
 
-WSA, ChromeOS, dan Android berbasis wadah juga dapat bekerja dengan KernelSU terintegrasi.
+Dengan dukungan ini WSA, ChromeOS, dan Android berbasis kontainer semuanya dapat dijalankan.
 
-Saat ini, arsitektur `arm64-v8a` dan `x86_64` didukung.
+Saat ini, arsitektur `arm64-v8a` dan `x86_64` sudah didukung.
 
 > [!CAUTION]
-> Versi kernel terbaru telah menerapkan perubahan yang merusak yang menyebabkan KernelSU gagal dan berpotensi memicu kernel panic pada `x86_64`! Cek situs web untuk info lebih lanjut!
+> Versi kernel terbaru menerapkan perubahan besar yang menyebabkan KernelSU gagal dan berpotensi memicu kernel panic pada `x86_64`! Cek situs web untuk informasi lebih lanjut!
 
 ## Penggunaan
 
-- [Petunjuk Instalasi](https://kernelsu.org/id_ID/guide/installation.html)
-- [Bagaimana cara membuat?](https://kernelsu.org/id_ID/guide/how-to-build.html)
+- [Pemasangan](https://kernelsu.org/id_ID/guide/installation.html)
+- [Cara Build](https://kernelsu.org/id_ID/guide/how-to-build.html)
 - [Situs Web Resmi](https://kernelsu.org/id_ID/)
 
 ## Terjemahan
 
-Untuk menerjemahkan KernelSU ke dalam bahasa Anda atau menyempurnakan terjemahan yang sudah ada, harap gunakan [Weblat](https://hosted.weblate.org/engage/kernelsu/).
+Untuk membantu penerjemahan KernelSU, kami tidak lagi menerima kontribusi terjemahan melalui Weblate. Semua terjemahan kini ditangani menggunakan LLM.
+
+Jika Anda ingin menambahkan dukungan untuk bahasa baru, silakan buat PR (Pull Request). Harap diperhatikan bahwa perubahan pada terjemahan bahasa Inggris dan Mandarin yang sudah ada tidak akan diterima.
 
 ## Diskusi
 
 - Telegram: [@KernelSU](https://t.me/KernelSU)
 
+## Keamanan
+
+Untuk informasi mengenai pelaporan kerentanan keamanan di KernelSU, lihat [SECURITY.md](/SECURITY.md).
+
 ## Lisensi
 
-- File di bawah direktori `kernel` adalah [GPL-2-only](https://www.gnu.org/licenses/old-licenses/gpl-2.0.en.html).
-- Semua bagian lain kecuali direktori `kernel` adalah [GPL-3.0-or-later](https://www.gnu.org/licenses/gpl-3.0.html).
+- Berkas di bawah direktori `kernel` berlisensi [GPL-2-only](https://www.gnu.org/licenses/old-licenses/gpl-2.0.en.html).
+- Seluruh bagian lainnya kecuali direktori `kernel` berlisensi [GPL-3.0-or-later](https://www.gnu.org/licenses/gpl-3.0.html).
 
 ## Kredit
 
-- [kernel-assisted-superuser](https://git.zx2c4.com/kernel-assisted-superuser/about/): ide KernelSU.
-- [Magisk](https://github.com/topjohnwu/Magisk): alat root yang ampuh.
-- [genuine](https://github.com/brevent/genuine/): validasi tanda tangan apk v2.
-- [Diamorphine](https://github.com/m0nad/Diamorphine): beberapa keterampilan rootkit.
+- [kernel-assisted-superuser](https://git.zx2c4.com/kernel-assisted-superuser/about/): Gagasan utama KernelSU.
+- [Magisk](https://github.com/topjohnwu/Magisk): Alat root yang andal.
+- [genuine](https://github.com/brevent/genuine/): Validasi tanda tangan APK v2.
+- [Diamorphine](https://github.com/m0nad/Diamorphine): Beberapa keahlian rootkit.
diff --git a/kernel/Makefile b/kernel/Makefile
@@ -1,21 +1,30 @@
 KDIR := $(KDIR)
 MDIR := $(realpath $(dir $(abspath $(lastword $(MAKEFILE_LIST)))))
 ODIR := $(MDIR)
+KMI := $(notdir $(patsubst %/,%,$(KDIR)))
+
+ifeq ($(KMI),android17-6.18)
+KBUILD_ARGS := M=$(MDIR) MO=$(ODIR)
+else
+KBUILD_ARGS := M=$(ODIR) src=$(MDIR)
+endif
 
 $(info -- KDIR: $(KDIR))
 $(info -- MDIR: $(MDIR))
 $(info -- OUTPUT DIR: $(ODIR))
+$(info -- KMI: $(KMI))
+$(info -- KBUILD_ARGS: $(KBUILD_ARGS))
 
 .PHONY: all compdb clean format check-format
 
 all: check_symbol
-	make -C $(KDIR) M=$(ODIR) src=$(MDIR) modules compile_commands.json -j$(shell nproc)
+	$(MAKE) -C $(KDIR) $(KBUILD_ARGS) modules compile_commands.json -j$(shell nproc)
 	./check_symbol $(ODIR)/kernelsu.ko $(KDIR)/vmlinux
 
 compdb:
 	python3 $(MDIR)/.vscode/generate_compdb.py -O $(ODIR) $(MDIR)
 clean:
-	make -C $(KDIR) M=$(ODIR) src=$(MDIR) clean
+	$(MAKE) -C $(KDIR) $(KBUILD_ARGS) clean
 	rm check_symbol
 check_symbol: tools/check_symbol.c
 	$(CC) tools/check_symbol.c -o check_symbol

diff --git a/kernel/build-all.sh b/kernel/build-all.sh
@@ -2,7 +2,7 @@
 set -e
 
 if [ -z "$1" ]; then
-    KMIS="android12-5.10 android13-5.10 android13-5.15 android14-5.15 android14-6.1 android15-6.6 android16-6.12"
+    KMIS="android12-5.10 android13-5.10 android13-5.15 android14-5.15 android14-6.1 android15-6.6 android16-6.12 android17-6.18"
 else
     KMIS=$1
 fi

diff --git a/kernel/feature/kernel_umount.c b/kernel/feature/kernel_umount.c
@@ -2,7 +2,6 @@
 #include <linux/slab.h>
 #include <linux/task_work.h>
 #include <linux/cred.h>
-#include <linux/compiler.h>
 #include <linux/fs.h>
 #include <linux/mount.h>
 #include <linux/namei.h>
@@ -20,7 +19,6 @@
 #include "ksu.h"
 
 static bool ksu_kernel_umount_enabled = true;
-bool ksu_webview_zygote_umount_enabled = false;
 
 static int kernel_umount_feature_get(u64 *value)
 {
@@ -43,27 +41,6 @@ static const struct ksu_feature_handler kernel_umount_handler = {
     .set_handler = kernel_umount_feature_set,
 };
 
-static int webview_zygote_umount_feature_get(u64 *value)
-{
-    *value = ksu_webview_zygote_umount_enabled ? 1 : 0;
-    return 0;
-}
-
-static int webview_zygote_umount_feature_set(u64 value)
-{
-    bool enable = value != 0;
-    ksu_webview_zygote_umount_enabled = enable;
-    pr_info("webview_zygote_umount: set to %d\n", enable);
-    return 0;
-}
-
-static const struct ksu_feature_handler webview_zygote_umount_handler = {
-    .feature_id = KSU_FEATURE_WEBVIEW_ZYGOTE_UMOUNT,
-    .name = "webview_zygote_umount",
-    .get_handler = webview_zygote_umount_feature_get,
-    .set_handler = webview_zygote_umount_feature_set,
-};
-
 extern int path_umount(struct path *path, int flags);
 
 static void ksu_umount_mnt(const char *mnt, struct path *path, int flags)
@@ -110,7 +87,7 @@ int ksu_handle_umount(uid_t old_uid, uid_t new_uid)
     // 1. Normal app: zygote -> appuid
     // 2. Isolated process forked from zygote: zygote -> isolated_process
     // 3. App zygote forked from zygote: zygote -> appuid
-    // 4. Webview zygote forked from zygote: zygote -> webview_zygote (controlled by feature policy)
+    // 4. Webview zygote forked from zygote: zygote -> webview_zygote
     // 5. Isolated process forked from app zygote: appuid -> isolated_process (already handled by 3)
     // 6. Isolated process forked from webview zygote (already handled by 4)
     if (!is_appuid(new_uid) && new_uid != WEBVIEW_ZYGOTE_UID && !is_isolated_process(new_uid)) {
@@ -153,13 +130,9 @@ void __init ksu_kernel_umount_init(void)
     if (ksu_register_feature_handler(&kernel_umount_handler)) {
         pr_err("Failed to register kernel_umount feature handler\n");
     }
-    if (ksu_register_feature_handler(&webview_zygote_umount_handler)) {
-        pr_err("Failed to register webview_zygote_umount feature handler\n");
-    }
 }
 
 void __exit ksu_kernel_umount_exit(void)
 {
-    ksu_unregister_feature_handler(KSU_FEATURE_WEBVIEW_ZYGOTE_UMOUNT);
     ksu_unregister_feature_handler(KSU_FEATURE_KERNEL_UMOUNT);
 }
diff --git a/kernel/feature/kernel_umount.h b/kernel/feature/kernel_umount.h
@@ -7,7 +7,6 @@
 
 void ksu_kernel_umount_init(void);
 void ksu_kernel_umount_exit(void);
-extern bool ksu_webview_zygote_umount_enabled;
 
 // Handler function to be called from setresuid hook
 int ksu_handle_umount(uid_t old_uid, uid_t new_uid);

diff --git a/kernel/policy/allowlist.c b/kernel/policy/allowlist.c
@@ -19,7 +19,6 @@
 
 #include "klog.h" // IWYU pragma: keep
 #include "ksu.h"
-#include "feature/kernel_umount.h"
 #include "runtime/ksud_boot.h"
 #include "selinux/selinux.h"
 #include "policy/allowlist.h"
@@ -299,9 +298,6 @@ bool ksu_uid_should_umount(uid_t uid)
         // we should not umount on manager!
         return false;
     }
-    if (unlikely(uid == WEBVIEW_ZYGOTE_UID)) {
-        return ksu_webview_zygote_umount_enabled;
-    }
 #ifdef CONFIG_KSU_DISABLE_POLICY
     return !__ksu_is_allow_uid(uid);
 #else
@@ -594,7 +590,7 @@ void ksu_prune_allowlist(bool (*is_uid_valid)(uid_t, char *, void *), void *data
         uid_t uid = np->profile.curr_uid;
         char *package = np->profile.key;
         // we use this uid for special cases, don't prune it!
-        bool is_preserved_uid = uid == KSU_APP_PROFILE_PRESERVE_UID;
+        bool is_preserved_uid = uid == KSU_APP_PROFILE_PRESERVE_UID || uid == WEBVIEW_ZYGOTE_UID;
         if (!is_preserved_uid && !is_uid_valid(uid, package, data)) {
             modified = true;
             pr_info("prune uid: %d, package: %s\n", uid, package);

diff --git a/kernel/selinux/sepolicy.c b/kernel/selinux/sepolicy.c
@@ -908,10 +908,14 @@ struct selinux_policy *ksu_dup_sepolicy(struct selinux_policy *old_pol)
     void *data;
     struct policy_file fp;
 
-    len = old_pol->policydb.len;
+    // Some MTK device policy db seems not marking type itself in type_attr_map_array
+    // policydb_read() adds each type to its own attribute map, so old_pol->policydb.len may be smaller
+    // preserve one ebitmap entry for this condition to avoid trigger -EINVAL
+    len = old_pol->policydb.len + (size_t)old_pol->policydb.p_types.nprim * (sizeof(u32) + sizeof(u64));
+
     data = vmalloc(len);
     if (!data) {
-        pr_err("alloc policy len %ld\n", len);
+        pr_err("alloc policy buffer len %zu\n", len);
         ret = -ENOMEM;
         goto out_free_data;
     }
@@ -924,6 +928,7 @@ struct selinux_policy *ksu_dup_sepolicy(struct selinux_policy *old_pol)
         pr_err("sepolicy: policydb_write: %d\n", ret);
         goto out_free_data;
     }
+    len -= fp.len;
     // https://android.googlesource.com/kernel/common/+/35a7845718734ae638b85b420534cb859498dab6%5E%21
 #if LINUX_VERSION_CODE < KERNEL_VERSION(6, 18, 0)
     // https://android-review.googlesource.com/c/kernel/common/+/3009995/11/security/selinux/ss/policydb.c
@@ -961,7 +966,7 @@ struct selinux_policy *ksu_dup_sepolicy(struct selinux_policy *old_pol)
         pr_err("sepolicy: policydb_read: %d\n", ret);
         goto out_free_policydb;
     }
-    new_pol->policydb.len = old_pol->policydb.len;
+    new_pol->policydb.len = len;
     kvfree(data);
 
     return new_pol;

diff --git a/manager/app/src/main/cpp/jni.cc b/manager/app/src/main/cpp/jni.cc
@@ -347,18 +347,6 @@ Java_me_weishu_kernelsu_Natives_setKernelUmountEnabled(JNIEnv *env, jobject thiz
     return set_kernel_umount_enabled(enabled);
 }
 
-extern "C"
-JNIEXPORT jboolean JNICALL
-Java_me_weishu_kernelsu_Natives_isWebViewZygoteUmountEnabled(JNIEnv *env, jobject thiz) {
-    return is_webview_zygote_umount_enabled();
-}
-
-extern "C"
-JNIEXPORT jboolean JNICALL
-Java_me_weishu_kernelsu_Natives_setWebViewZygoteUmountEnabled(JNIEnv *env, jobject thiz, jboolean enabled) {
-    return set_webview_zygote_umount_enabled(enabled);
-}
-
 extern "C"
 JNIEXPORT jboolean JNICALL
 Java_me_weishu_kernelsu_Natives_isSelinuxHideEnabled(JNIEnv *env, jobject thiz) {

diff --git a/manager/app/src/main/cpp/ksu.cc b/manager/app/src/main/cpp/ksu.cc
@@ -216,22 +216,6 @@ bool is_kernel_umount_enabled() {
     return value != 0;
 }
 
-bool set_webview_zygote_umount_enabled(bool enabled) {
-    return set_feature(KSU_FEATURE_WEBVIEW_ZYGOTE_UMOUNT, enabled ? 1 : 0);
-}
-
-bool is_webview_zygote_umount_enabled() {
-    uint64_t value = 0;
-    bool supported = false;
-    if (!get_feature(KSU_FEATURE_WEBVIEW_ZYGOTE_UMOUNT, &value, &supported)) {
-        return false;
-    }
-    if (!supported) {
-        return false;
-    }
-    return value != 0;
-}
-
 int set_selinux_hide_enabled(bool enabled) {
     if (!set_feature(KSU_FEATURE_SELINUX_HIDE, enabled ? 1 : 0)) {
         return -errno;

diff --git a/manager/app/src/main/cpp/ksu.h b/manager/app/src/main/cpp/ksu.h
@@ -46,11 +46,6 @@ bool set_kernel_umount_enabled(bool enabled);
 
 bool is_kernel_umount_enabled();
 
-// WebView zygote umount
-bool set_webview_zygote_umount_enabled(bool enabled);
-
-bool is_webview_zygote_umount_enabled();
-
 // SELinux hide
 int set_selinux_hide_enabled(bool enabled);
 

diff --git a/manager/app/src/main/java/me/weishu/kernelsu/Natives.kt b/manager/app/src/main/java/me/weishu/kernelsu/Natives.kt
@@ -80,9 +80,6 @@ object Natives {
     external fun isKernelUmountEnabled(): Boolean
     external fun setKernelUmountEnabled(enabled: Boolean): Boolean
 
-    external fun isWebViewZygoteUmountEnabled(): Boolean
-    external fun setWebViewZygoteUmountEnabled(enabled: Boolean): Boolean
-
     /**
      * SELinux hide can be disabled temporarily.
      *  0: disabled
-Original file line number
+Diff line change
@@ Expand Up / @@ -2,7 +2,7 @@ @@
     set -e
     if [ -z "$1" ]; then
-        KMIS="android12-5.10 android13-5.10 android13-5.15 android14-5.15 android14-6.1 android15-6.6 android16-6.12"
+        KMIS="android12-5.10 android13-5.10 android13-5.15 android14-5.15 android14-6.1 android15-6.6 android16-6.12 android17-6.18"
     else
         KMIS=$1
     fi
@@ Expand Down @@