I'm using a Nexus 5X with release 6.0.0 (MDB08M). I unlocked the bootloader with fastboot oem unlock, then created a boot image with a /default.prop file containing ro.secure=0. This appears to work, in that when I boot my device, I get:
shell@bullhead:/ $ getprop ro.secure
0
Unfortunately, though adb root seems to succeed and reports:
restarting adbd as root
It does not get me a root shell. ps confirms adbd is still running as the shell user. My question is how to make adbd obey ro.secure, or whether there is some other easy way to get root by modifying /default.prop or changing the kernel command-line arguments. I know there are third-party tools such as SuperSU, but I'm hoping to get a root shell without loading any third-party software on my phone.
To reproduce what I did, you can grab boot.img out of the Nexus factory image (unzipping image-bullhead-mdb08m.zip). Unpack the boot image using split_bootimg_pl. Unpack and repack boot.img-ramdisk.gz (I packed it using find . | bsdcpio -R 0:0 -H newc -o |gzip -9 > ../newramfs.gz). Create a new-boot.img using mkbootimg as follows:
mkbootimg -o new-boot.img --pagesize 4096 --base 0 --kernel_offset 0x8000 --ramdisk_offset 0x2000000 --tags_offset 0x1e00000 --kernel boot.img-kernel --ramdisk boot.img-ramdisk.gz --cmdline "console=ttyHSL0,115200,n8 androidboot.hardware=bullhead boot_cpus=0-5 lpm_levels.sleep_disabled=1 msm_poweroff.download_mode=0"
And finally of course flash new-boot.img with fastboot flash boot new-boot.img.
