1

I am trying to root my android 6.0.1 phone using the following method:

I first booted into a TWRP image using fastboot boot, then using the TWRP terminal I copied the su binary from the SuperSU kit to /system/xbin/ and ran chmod 6755 ./su, chown root:root ./su and chcon u:object_r:system_file:s0 ./su. Now I booted into Android and opened a terminal emulator and goto /system/xbin/ and see that the SUID bit is set for su. But when I run su, nothing happens and the binary exits with a 0 value.

Running strace su shows that the setresuid() and setuid() calls are failing. I suspect this is because of SELinux contexts.

What should the SELinux contexts be for the binary?

0

Apps can't elevate their privileges by making use of set-uid-root or file capabilities. It's due to Security Enhancements in Android 4.3:

  • No setuid/setgid programs. Added support for filesystem capabilities to Android system files and removed all setuid/setguid programs. This reduces root attack surface and the likelihood of potential security vulnerabilities.
  • Restrict Setuid from Android Apps. The /system partition is now mounted nosuid for zygote-spawned processes, preventing Android applications from executing setuid programs. This reduces root attack surface and the likelihood of potential security vulnerabilities.
  • Capability bounding. Android zygote and ADB now use prctl(PR_CAPBSET_DROP) to drop unnecessary capabilities prior to executing applications. This prevents Android applications and applications launched from the shell from acquiring privileged capabilities.
  • NO_NEW_PRIVS. Android zygote now uses prctl(PR_SET_NO_NEW_PRIVS) to block addition of new privileges prior to execution application code. This prevents Android applications from performing operations which can elevate privileges via execve. (This requires Linux kernel version 3.5 or greater).

Default SELinux context of /system/xbin/su is u:object_r:su_exec:s0 but it may not be the only constraint.

For more details see:

Also:

-1

Impossible to say with that little information. You said:

...and ran chmod 6755 ./su, chown root:root ./su and chcon u:object_r:system_file:s0 ./su

This seem to imply you are already root. If it's SELinux problem, you shouldbe able to see this in logcat -b main *:V.

  • I am root in the TWRP terminal, but not in Android. – nom May 22 '17 at 16:36
  • What I am asking is, what should be the correct SELinux context for the program. – nom May 22 '17 at 16:40
  • Also, please elaborate on what information you would require. – nom May 22 '17 at 16:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.