FinaSU is a kernel-based root solution for Android, built on KernelSU. It combines kernel-level su and root access management with a module system, a built-in Zygisk engine, SUSFS support, and a configurable modern manager.
FinaSU provides:
- Kernel-based
suwith whitelist-based root access management - A Magisk-like module system based on overlayfs and metamodules
- App Profile, to confine root power to a per-app policy
- The built-in FolkZygisk engine, with manager controls
- The built-in Sui extension, which serves the Shizuku API to supported apps
- SUSFS support, gated by kernel capability
- Kernel-level hiding: mount hiding, SELinux hiding, AVC log spoofing, and unmount policy
.fptthemes with FolkPatch-compatible exchange, plus an online theme store- Multi-page wallpapers, custom fonts, and a launcher icon switcher
- Module repository browsing and one-tap installation
- An in-app language picker with community translations
- An ARM64 (arm64-v8a) Android device;
x86_64andriscv64hooks are also present - A GKI kernel (5.10+) is recommended; 4.14+ is supported but requires building the kernel manually
- Installation via LKM (a loadable
kernelsu.ko), a patched boot image, or an AnyKernel3 package
- Multiple home layouts, including GridUI and dashboard-style pages
- Configurable theming: colors, wallpapers, and fonts
- A category-based settings hub covering general, appearance, behavior, function, security, and multimedia options
- Optional update checks and boot-time module blocking
Standard KernelSU modules are managed from the manager. A single active metamodule can provide the mount backend, and FinaSU warns when an enabled metamodule may not be compatible with the built-in engine.
FolkZygisk is a built-in Zygisk engine. The manager exposes its installation and activation controls, and ksud steps the built-in engine aside whenever an external Zygisk provider is active, so provider modules install normally.
Sui is the built-in Shizuku API backend, for the apps that talk to Shizuku: they reach this extension instead of a separate Shizuku installation. The payload is built by this repository and embedded in ksud, so installation, enable and disable, and repair belong to FinaSU rather than to Sui's own installer, and ksud supervises the injected root and shell servers.
The manager hosts the whole interface: the per-app Shizuku permission list, the default permission, the apps hidden from Sui, diagnostics, and the prompt for a real permission request, which is answered over the management channel. Sui's own management UI is not shipped.
SUSFS management is capability-gated. The controls appear only on kernels that support it, and every configuration change is applied with a receipt.
Folk-Mount is the built-in module mount engine. It can run in auto, built-in, or metamodule mode.
NoMount is the built-in VFS redirection backend: instead of mounting anything it takes over path resolution and directory iteration in a kernel module, so /proc/mounts stays clean. The module ships inside ksud (embedded per KMI, built by this repository); the backend needs neither a metamodule nor the nm binary.
The manager exposes the driver state, the number of active rules, visibility exclusions and a "mounting off" mode; the backend can be set to automatic, built-in Folk Mount, metamodule only, NoMount or off. Mounting stays on the default automatic mode, so NoMount is only entered when it is selected. Choosing NoMount falls back to the built-in engine when the driver is unavailable and says so on the settings page. ksud also records each risky step before it runs: if a NoMount (or metamodule) injection never reached boot completion, the next boot skips that provider and mounts with the built-in engine instead, and the reason lands in /data/adb/ksu/log/mount.log — the same bounded, rotated log that records how many rules each boot injected and which directories they landed in, which is what a bug report needs to tell whether an injection touched a boot-critical path. To find out what a stuck boot was waiting for, arm ksud mount capture on first (150s after a boot that never finishes, or ksud mount capture on 60; off disarms): the capture lands in /data/adb/ksu/log/mount_capture.log with the blocked-task stacks from sysrq w, the end of the kernel log, the D-state tasks and pstore. Visibility is an exception list kept by ksud: every app sees the injected files until it is added, and the NoMount page copies each app profile's "unmount modules" verdict into that list on demand, so later profile changes need another copy.
Directory symlinks are traversed as directories and merged file by file, with cycle detection and per-module path deduplication. A .replace marker or opaque directory defaults to file merging; only the explicitly allowlisted /product/fonts target may become a directory redirect, and only when its stock target is absent or empty. Partition roots and directories named lib64, lib, bin or etc are never directory-replaced. Downgrades are logged, mount.log includes dir_replace=N, and ksud nomount inject --dry-run --verbose labels file redirects and directory replacements separately.
The built-in NoMount provider also starts a detached UI-readiness observer (180 seconds by default). It requires sys.boot_completed=1, a running SurfaceFlinger and a stopped boot animation, not just the boot-completed callback. An observation that runs and does not confirm readiness leaves a persistent marker, so the next boot uses the built-in mount engine and records a warning; one that never ran—the device rebooted before the deadline, or the helper died—is treated as inconclusive, is dropped, and NoMount keeps running. These signals do not guarantee a working display, and this is not an in-kernel loader timeout. Set /data/adb/ksu/mount_ui_guard to delay=300 to change the observation deadline (30–900 seconds), or off to stop arming new observations. A confirmed-failure marker clears itself once a boot with the built-in engine mounts successfully, so keep the /data/adb/ksu/log/mount.log from the failed boot before retrying.
The manager authenticates itself by APK signature: only the trusted manager and apps the user has explicitly claimed can manage the kernel. Root access is whitelist-based, so only granted apps can reach su. See SECURITY.md for vulnerability reporting.
English and Chinese are the reference languages. Only submit corrections for the target language, and include the entire translated file when adding a new language.
- Download the latest package from the Releases page.
- Install the manager on the device.
- Follow the in-app flow to install the kernel module, patch a boot image, or flash an AnyKernel3 package.
The repository ships a local mirror of the CI pipeline:
./build.sh ksud # build the Rust userspace daemon
./build.sh lkm # build the kernel module
./build.sh apk # build the manager APK (requires the ksud build)
./build.sh all # full local runSee AGENTS.md for the per-component build and check commands.
- KernelSU - upstream project
- ReZygisk - FolkZygisk is adapted from it
- YukiSU - dynamic manager reference
- BakaSU - AnyKernel3 flashing, predictive back navigation and smaller-feature reference
- Magisk -
magiskpolicyand module concepts - SUSFS - kernel-level hiding
- Sui - the built-in Shizuku API backend
- Shizuku-API - the Shizuku client API library
- FolkPatch - theme format and design reference
- MMRL - module repository format reference
- Files under the
kerneldirectory are GPL-2.0-only. - All other parts are GPL-3.0.
- Telegram: @FinaSU