106 lines
4.9 KiB
Markdown
106 lines
4.9 KiB
Markdown
# RKNnoVPN Module Ownership
|
|
|
|
This module is split by root-runtime responsibility, not by historical script
|
|
entrypoint.
|
|
|
|
## Entry Points
|
|
|
|
- `customize.sh` installs files, records the release catalog, and disables
|
|
autostart until the app starts the runtime. It does not preserve APK-owned
|
|
profile data.
|
|
- `post-fs-data.sh` is early boot only: create the data skeleton and apply
|
|
basic permissions. It must not change kernel networking state or clean
|
|
runtime markers.
|
|
- `service.sh` is late boot only: wait for boot completion, prepare logs, and
|
|
leave runtime control to APK-triggered `rknnovpn-runtime`. It must not probe,
|
|
reset, or clean root networking at boot.
|
|
- `bin/xray` is an optional runtime sidecar owned by the root runtime and used only
|
|
for VLESS/XHTTP profiles. sing-box remains the owner of TPROXY, DNS, routing,
|
|
and all non-XHTTP profiles.
|
|
- `scripts/rescue_reset.sh` is the canonical root cleanup API.
|
|
- `scripts/privacy_guard.sh` owns best-effort Android package visibility
|
|
hardening for sensitive direct apps. It must not claim or implement
|
|
netfilter/procfs cleanup.
|
|
- `uninstall.sh` delegates runtime cleanup to `scripts/rescue_reset.sh` and
|
|
only removes uninstall-specific generated runtime files and obsolete external
|
|
cleanup hooks.
|
|
|
|
## Shared Runtime Library
|
|
|
|
Module scripts should use the shared files under `scripts/lib/`:
|
|
|
|
- `rknnovpn_env.sh` owns canonical paths, marker helpers, and shared
|
|
permission/layout helpers.
|
|
- `rknnovpn_install.sh` owns install/release-catalog helper behavior shared by
|
|
Magisk/KSU/APatch installation and staged module updates.
|
|
- `rknnovpn_installer_flow.sh` owns the Magisk/KSU/APatch install flow:
|
|
preflight, fresh runtime config reset, binary/script copy, release catalog, and
|
|
permissions. `customize.sh` must stay a thin entrypoint.
|
|
- `rknnovpn_netstack.sh` owns generic RKNnoVPN netfilter/policy-routing
|
|
cleanup helpers used by rescue/uninstall paths.
|
|
- `rknnovpn_iptables_rules.sh` owns TPROXY rule rendering and listener
|
|
protection verification. `scripts/iptables.sh` must stay orchestration:
|
|
validate env, snapshot, apply, teardown, and status dispatch.
|
|
|
|
Both Magisk/KSU/APatch installation (`customize.sh`) and the runtime staged-update
|
|
installer must treat all `scripts/lib/*.sh` files as required module files.
|
|
|
|
Runtime staged updates must materialize a complete pending module under the
|
|
root-manager update directory (`modules_update/rknnovpn` for Magisk-compatible
|
|
layouts, or the KernelSU/APatch equivalent). That pending module must include
|
|
the same runtime-owned scripts/libs and installed release catalog metadata that
|
|
`customize.sh` creates for a fresh install; it must not depend on a raw zip being
|
|
interpreted later. The active module's `releases/` catalog records installed
|
|
release metadata only; it is not a pending-update zip queue.
|
|
|
|
The library owns these path names:
|
|
|
|
- `RKNNOVPN_DIR=/data/adb/modules/rknnovpn`
|
|
- `BIN_DIR`, `CONFIG_DIR`, `SCRIPTS_DIR`, `RUN_DIR`, `LOG_DIR`
|
|
- `RUNTIME_CONFIG_FILE=/data/adb/modules/rknnovpn/config/config.json`
|
|
- `RESET_LOCK`, `ACTIVE_FILE`, `MANUAL_FLAG`
|
|
- `SINGBOX_PID_FILE`
|
|
|
|
Module config is not a user profile store. The APK owns user profile data; the
|
|
module consumes the rendered runtime config at `config/config.json`.
|
|
|
|
## Marker Ownership
|
|
|
|
- `run/reset.lock`
|
|
- Created by `rescue_reset.sh` when entering reset/cleanup mode.
|
|
- Removed by `rescue_reset.sh` after `hard-reset`, `update-clean`, or
|
|
`uninstall-clean`.
|
|
- Preserved while runtime cleanup is active so the reset window remains
|
|
externally visible until cleanup completes.
|
|
- Must not be removed by `post-fs-data.sh` or `service.sh`.
|
|
|
|
- `config/manual`
|
|
- Created by installer and user-visible hard reset paths.
|
|
- Prevents boot/autostart from resurrecting proxy rules.
|
|
- `update-clean` and `uninstall-clean` must not create it.
|
|
|
|
- `run/active`
|
|
- Runtime liveness marker for network-change handling.
|
|
- Cleared when entering reset/manual mode.
|
|
- Must not be blindly removed by `post-fs-data.sh` or `service.sh`.
|
|
|
|
## Cleanup Ownership
|
|
|
|
`scripts/rescue_reset.sh` is the only script that should implement complete
|
|
RKNnoVPN-owned cleanup of processes, DNS rules, iptables chains, policy
|
|
routing, and runtime snapshots.
|
|
|
|
Other entrypoints may call it, but should not grow a parallel netfilter cleanup
|
|
implementation. If `rescue_reset.sh` is missing, entrypoints should report that
|
|
runtime cleanup is unavailable rather than partially reimplementing process,
|
|
marker, or netfilter cleanup.
|
|
|
|
## Netstack Ownership
|
|
|
|
- `scripts/iptables.sh` owns applying/removing mangle rules, policy routing,
|
|
and runtime snapshots in `run/env.sh`; rule text and listener verification
|
|
belong in `scripts/lib/rknnovpn_iptables_rules.sh`.
|
|
- `scripts/dns.sh` owns classic DNS nat interception.
|
|
- `scripts/privacy_guard.sh` owns persistent `QUERY_ALL_PACKAGES` AppOps
|
|
hardening for resolved always-direct packages. It is intentionally not part
|
|
of reset cleanup because it does not create RKNnoVPN netstack state.
|