Does avbroot work with KernelSU's LKM?

[BluCobalt]

KernelSU recently added the ability to be loaded as a kernel module, rather than as a completely new kernel. Does this work with avbroot? From what I can tell, the new installation method patches init_boot similar to what magisk does on newer phones, and can be done by the manager in user space. With magisk, you can supply a prepatched image and specify the target slot. Would that work with KernelSU?

[chenxiaolong]

I don't have any immediate plans for adding support for this (#264). For some reason, the KernelSU developers have decided to make a portion of this new functionality (ksuinit) closed-source. I don't believe the developers to be malicious at all, but at the same time, I'm not willing to run code that I can't easily inspect, especially something that has as much privileges as ksuinit does.

I may still add support for this in the future, but it will not be something I've personally tested on my own devices.

[BluCobalt]

Thank you, I understand now. Ksuinit being closed source makes me......hesitant over it being ran on my phone. I think I'll stick with gki.

[pixincreate]

@chenxiaolong, I did try to boot kernelSU via LKM by booting it, that did not seem to work. I did also flash the boot img that I got after patching in KernelSU manager, even after that the manager kept saying KernelSU is not installed.

It might be that GrapheneOS kernel hardening is stopping LKM from being loaded, haven't digged into it.

[chenxiaolong]

Yep, looks like GrapheneOS' kernel enforces signature verification for all kernel modules: GrapheneOS/kernel_common-6.1@7995bde

[pixincreate]

So there's nothing we can do about it without disabling signature verification?

Self signing should pass signature verification?

Nvm, got the answer from here