Error: "Operation not permitted", when attempting to remove su binary placed by KingoRoot

Question

I rooted my P8-Lite ALE-L21 (Android 5.0.1) with supersu.zip through TWRP recovery. After that I installed KingoRoot and KingoRoot replaced su binary with some other su binary which is obsolete for my Android version and not working. So I modified supersu.zip and placed su binary into another directory in /data/local. Now my working su binary is in /data/local and it works fine with adb, but does not work with SuperSU and other applications which use root privilege.

To solve that issue, I tried to remove these old su binaries:/system/bin/su and /system/xbin/su, with the following commands unsuccessfully:

$ adb shell
shell@hwALE-H:/ $ /data/local/su
root@hwALE-H:/ # mount -o remount,rw /system
root@hwALE-H:/ # rm /system/xbin/su
rm: /system/xbin/su: Operation not permitted
1|root@hwALE-H:/ # rm -rf /system/xbin/su
rm: /system/xbin/su: Operation not permitted

• What is this error: Operation not permitted?
• How can I remove those su files?

Answer 1

Given this link about mount's output, it is at least confirmed that system partition is mounted in read-write mode, so we can exclude that from the list of possibilities that may be restricting rm from deletion. Plus, the error would be different too.

Since you're running the command with superuser privilege, different file owner or group owner of that su file shouldn't the cause here. It most likely would have something to do with file attributes.

To check file attributes we need lsattr tool. Android doesn't come with that tool, so you're left with no choice but to install busybox or toybox. Since your standard root is botched, you cannot install busybox binary using an app. It would fail. In that case, download the binary of busybox or toybox appropriate for your device, rename the binary to busybox or toybox, push it into /data/local/tmp/ and set executable permission on that file. Permission can be set using chmod. Do:

adb shell /data/local/su -c chmod 755 /data/local/tmp/<FILE>  # replace <FILE> with toybox or busybox

Test the binary using

adb shell /data/local/tmp/<FILE>   # replace <FILE> with toybox or busybox

If it works then execute

adb shell /data/local/tmp/<FILE> lsattr /system/xbin/su       

Per the output in chat, the file attributes are

-----a-A----- /system/xbin/su

According to manual of chattr,

When a file with the 'A' attribute set is accessed, its atime record is not modified. This avoids a certain amount of disk I/O for laptop systems.

A file with the 'a' attribute set can only be open in append mode for writing. Only the superuser or a process possessing the CAP_LINUX_IMMUTABLE capability can set or clear this attribute.

atime → last access time.

A file with 'a' attribute cannot be rename, delete, or overwritten, but can only be append. So that's the reason rm was throwing the error operation not permitted. (I'm surprised KingoRoot didn't place i attribute.)

Anyhow, we must remove that attribute first. Do:

adb shell /data/local/su -c /data/local/tmp/<FILE> chattr -a /system/xbin/su

It may not give any output unless an error occurs. Now, check the file attributes again using lsattr:

adb shell /data/local/tmp/<FILE> lsattr /system/xbin/su

It should now be

-------A----- /system/xbin/su 

That attribute has been removed and you're free to rename, delete and overwrite that file. To remove the file, simply do

adb shell /data/local/su -c rm -f /system/xbin/su    

Follow the process for any other file, if it cannot be deleted by rm at once. If lsattr reports i as well, then remove it using -i in chattr.