Take the 2-minute tour ×
Android Enthusiasts Stack Exchange is a question and answer site for enthusiasts and power users of the Android operating system. It's 100% free, no registration required.

Since today, I see the following root warning when turning wifi on or off:

enter image description here

  • Superuser Anfrage / Superuser request: mksh (1000)
  • Angeforderter Benutzer / Requested User: ROOT (0)
  • Befehl / Command: ip route add 224.0.0.0/4 dev wlan0

My phone is a HTC One V with Android 4.0.3 and SuperSU installed as root app. It was running 8 months without this prompt. My last install was Power Toggles 1 week ago. Does anyone know about this? I'm afraid it's something dangerous...

share|improve this question
    
thx izzy for including the image. I didn't have enough reputation to do it. –  Daniel Alder Feb 25 '13 at 21:03
    
Now, why would Power Toggles be requesting to add a broadcast to the routes? Can you post the contents of mksh to confirm? I'd be suspicious of that! :) –  t0mm13b Feb 25 '13 at 21:45
    
how can I do this? the message is the only thing I see about it and I think/hope there is not more than this ip route command –  Daniel Alder Feb 25 '13 at 22:00
    
I just found something in the middle of a very long forum thread: forum.xda-developers.com/showthread.php?p=33550523. Seems that it appears after an update of superSU which didn't show system commands in previous version. Interestingly, the message is from november. And I'm sure I did multiple updates of superSU since then. And another interesting thing: why should the system-app HTC sense use a rooting tool for executing a command? –  Daniel Alder Feb 25 '13 at 22:23

1 Answer 1

up vote 0 down vote accepted

mksh(1) is “just” the system shell on Android (has been for a few versions by now). The request basically means that some other application is trying to run a shell command with root permissions, which the dialogue then attributes to the shell instead of the program/library actually requesting it (on whose behalf mksh is operating).

There are several very long threads acting on it; this one has got a good summary, out of which the most important points are:

  • the "ip route add" command comes from libChange.so in HTC Sense ROMs (thanks to chrisch1974 for finding it), which itself is already running as a system component
  • the command itself is not malicious, but there's no clear reason why HTC Sense should run this command
  • the reason it shows up in SuperSU v0.97 and does not show up in older versions is because v0.97 no longer automatically grants root to the shell and system processes
  • 224.0.0.0/4 is the standard IP multicast range - this command just forces multicasting out of the wifi interface (since AFAIK cell carriers don't allow multicasting on their data connections). This prevents multicast traffic from attempting to use the mobile network connection and failing.
  • If you have used the adb shell command on any previous phone and got the root prompt, #, instead of the user prompt, $, by default then your shell has been this way before. I've seen it come and go.

In the end, most people agree that saying Yes here seems to be harmless.

Disclaimer: I’m the mksh maintainer.

share|improve this answer
    
Thx for this summary. I want to add: Saying 'No' also seems to be harmless :-) –  Daniel Alder Mar 7 at 20:18
    
@DanielAlder indeed, it seems to be harmless. As I quoted, this command mostly sets up multicast traffic to go over the WLAN instead of over the GSM/UMTS. Multicast is not really used much ;) –  mirabilos Mar 7 at 21:23
    
Last question: HTC uses mksh for changing this route. mksh is only installed on rooted devices. Does this mean, Multicasts are only routed over WLAN on rooted devices? This doesn't really make sense... –  Daniel Alder Mar 8 at 18:41
    
No, mksh is installed on all Android devices since AOSP post-1.6 (although I did add it to an 1.5 tree at a coworker's project), Android-x86 at the same time, Android 2.4 (which never was) and later (3.0/4.0). –  mirabilos Mar 8 at 22:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.