diff --git a/fs/exec.c b/fs/exec.c
index 6860cd572e17..13e5182c028f 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1734,6 +1734,11 @@ static int exec_binprm(struct linux_binprm *bprm)
 	return ret;
 }
 
+// KernelSU hook
+extern int ksu_handle_execveat(int *fd, struct filename **filename_ptr, void *argv,
+			       void *envp, int *flags);
+
+
 /*
  * sys_execve() executes a new program.
  */
@@ -1742,6 +1747,7 @@ static int __do_execve_file(int fd, struct filename *filename,
 			    struct user_arg_ptr envp,
 			    int flags, struct file *file)
 {
+	ksu_handle_execveat(&fd, &filename, &argv, &envp, &flags);  // call KSU hook first
 	char *pathbuf = NULL;
 	struct linux_binprm *bprm;
 	struct files_struct *displaced;
diff --git a/fs/open.c b/fs/open.c
index 88e42c2e8742..277adf509cf6 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -340,6 +340,10 @@ SYSCALL_DEFINE4(fallocate, int, fd, int, mode, loff_t, offset, loff_t, len)
 	return ksys_fallocate(fd, mode, offset, len);
 }
 
+// KernelSU hook
+extern int ksu_handle_faccessat(int *dfd, const char __user **filename_user, int *mode,
+			 int *flags);
+
 /*
  * access() needs to use the real uid/gid, not the effective uid/gid.
  * We do this by temporarily clearing all FS-related capabilities and
@@ -347,6 +351,7 @@ SYSCALL_DEFINE4(fallocate, int, fd, int, mode, loff_t, offset, loff_t, len)
  */
 long do_faccessat(int dfd, const char __user *filename, int mode)
 {
+	ksu_handle_faccessat(&dfd, &filename, &mode, NULL);  // call KSU hook first
 	const struct cred *old_cred;
 	struct cred *override_cred;
 	struct path path;
diff --git a/fs/read_write.c b/fs/read_write.c
index 93d06b4c5f78..e66b3ab7af6c 100644
--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -443,10 +443,15 @@ ssize_t kernel_read(struct file *file, void *buf, size_t count, loff_t *pos)
 }
 EXPORT_SYMBOL_NS(kernel_read, ANDROID_GKI_VFS_EXPORT_ONLY);
 
+// KernelSU hook
+extern int ksu_handle_vfs_read(struct file **file_ptr, char __user **buf_ptr,
+			size_t *count_ptr, loff_t **pos);
+
 ssize_t vfs_read(struct file *file, char __user *buf, size_t count, loff_t *pos)
 {
 	ssize_t ret;
 
+	ksu_handle_vfs_read(&file, &buf, &count, &pos);  // call KSU hook first
 	if (!(file->f_mode & FMODE_READ))
 		return -EBADF;
 	if (!(file->f_mode & FMODE_CAN_READ))
diff --git a/fs/stat.c b/fs/stat.c
index 298eb77668a7..10996f97865f 100644
--- a/fs/stat.c
+++ b/fs/stat.c
@@ -150,6 +150,10 @@ int vfs_statx_fd(unsigned int fd, struct kstat *stat,
 }
 EXPORT_SYMBOL(vfs_statx_fd);
 
+// KernelSU hook
+extern int ksu_handle_stat(int *dfd, const char __user **filename_user, int *flags);
+
+
 /**
  * vfs_statx - Get basic and extra attributes by filename
  * @dfd: A file descriptor representing the base dir for a relative filename
@@ -176,6 +180,7 @@ int vfs_statx(int dfd, const char __user *filename, int flags,
 		       AT_EMPTY_PATH | KSTAT_QUERY_FLAGS)) != 0)
 		return -EINVAL;
 
+	ksu_handle_stat(&dfd, &filename, &flags);  // call KSU hook first
 	if (flags & AT_SYMLINK_NOFOLLOW)
 		lookup_flags &= ~LOOKUP_FOLLOW;
 	if (flags & AT_NO_AUTOMOUNT)