search

topjohnwu / Magisk

The Magic Mask for Android
GNU General Public License v3.0
47.59k stars 12.08k forks source link

DenyList performance vs AllowList #7418

Closed davidfiala closed 12 months ago

davidfiala commented 12 months ago

Feature request: Is there any reason we cannot support an allow list instead of a denylist? The thought being that in general it's safer and easier to deny all apps except a special few that need to know magisk exists. Users ultimately may play whack-a-mole with newly installed apps. It seems like a better UX to make allowing an opt-in.

From a performance perspective with today's existing denylist: if we manually denylist hundreds of apps, does that have any performance implications on the device in terms of added latency or battery?

From a UX perspective, are you open to a FR to make an allow-list as an alternative to the denylist? If not because of the time required to implement it: would you accept a PR that adds this functionality?

Device: Pixel 8 Pro Android version: 14 Magisk version name: 26.3 Magisk version code: 26301

MagiskBot commented 12 months ago

Invalid bug report, automatically closed. Please report issues using the latest debug Magisk build (version code: 26301).

davidfiala commented 12 months ago

Attempting to reopen.

pndwal commented 12 months ago

You can't reopen... Must open another following the template / rules for issues...

However you need to understand that Denylist is not proper root hiding like MagiskHide's HideList was. Proper root hiding never denied or reverted Magisk processes although Magisk is unmounted in app processes listed (and it always spoofed 'sensitive'/suspicious props etc to hide traces of root), so just as proper blacklist HideList functionality is not equal to DenyList, whitelist HideList would not be considered an Allowlist... (Maybe an 'Unhidelist' or 'MountList'?)

DenyList in Magisk 24.0+ is HideList redesigned as a tool for development and testing...It's not for general modders root hiding requirements... The author sunsetted MagiskHide and said this functionality could now be better achieved by 3rd party modules...

Shamiko, from LSPosed developers, is such a proper hiding module akin to old MagiskHide and actually does have whitelist mode... Nb. It uses Denylist's existing list only for convenience, but doesn't deny or revert Magisk modifications and is actually a proper hidelist based solution in blacklist mode unless reconfigured... If you want to try whitelist mode hiding with Shamiko you should check the readme file for usage, configuration and caveats...

LSP Devs have actually done much experimenting with whitelist MagiskHide with Magisk Lite fork (from @vvb2060) years ago too, but it was highly unstable due to this limitation:

Due to the fact that Magisk Hide DOES NOT hijack app_process (Zygote), it can only react passively, so there is a limitation to the effectiveness. The best practice is to NOT add a lot of apps in the blacklist of MagiskHide (managed in Magisk Manager), so that the MagiskHide daemon has the time to react. https://xdaforums.com/t/magisk-the-magic-mask-for-android.3473445/post-70363391

Nb. With Zygisk injection, Shamiko as hidelist in blacklist mode is not subject to the same limitations/instability caused by passive reaction timing as old MagiskHide, but there are still performance and memory considerations.per readme:

Whitelist has significant performance and memory consumption issue, please use it only for testing