use syscall table hook, replace some GFP_ATOMIC to GFP_KERNEL

[5ec1cff]

No description provided.

[Copilot]

Pull request overview

This PR replaces kprobe-based syscall hooking with direct syscall table modification for execve and read syscalls, and changes memory allocation flags from GFP_ATOMIC to GFP_KERNEL in SELinux policy functions. The change aims to improve reliability and performance by using syscall table hooks instead of kprobes.

• Replaced kprobe hooks with direct syscall table modifications for sys_execve and sys_read
• Changed GFP_ATOMIC to GFP_KERNEL for memory allocations in SELinux policy manipulation functions
• Added official manager APK signature verification alongside custom signature checks

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
kernel/ksud.c	Implements syscall table hooking mechanism replacing kprobe handlers; adds cache invalidation logic and removes kprobe-related work queues for execve and read hooks
kernel/selinux/sepolicy.c	Changes allocation flags from GFP_ATOMIC to GFP_KERNEL for kzalloc, kcalloc, kstrdup, and kvrealloc calls
kernel/apk_sign.c	Adds fallback check for official manager APK signature in addition to custom signature
kernel/Kbuild	Adds build-time detection for dcache invalidation API variant and defines official APK signature constants
kernel/Makefile	Adds CONFIG_KSU=m flag to module build command
.github/workflows/build-lkm.yml	Disables fail-fast strategy to allow all matrix builds to complete

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.