1

I am trying to root my android 6.0.1 phone using the following method:

I first booted into a TWRP image using fastboot boot, then using the TWRP terminal I copied the su binary from the SuperSU kit to /system/xbin/ and ran chmod 6755 ./su, chown root:root ./su and chcon u:object_r:system_file:s0 ./su. Now I booted into Android and opened a terminal emulator and goto /system/xbin/ and see that the SUID bit is set for su. But when I run su, nothing happens and the binary exits with a 0 value.

Running strace su shows that the setresuid() and setuid() calls are failing. I suspect this is because of SELinux contexts.

What should the SELinux contexts be for the binary?

Improve this question

2 Answers 2

Reset to default
1

Apps can't elevate their privileges by making use of set-uid-root or file capabilities. It's due to Security Enhancements in Android 4.3:

  • No setuid/setgid programs. Added support for filesystem capabilities to Android system files and removed all setuid/setguid programs. This reduces root attack surface and the likelihood of potential security vulnerabilities.
  • Restrict Setuid from Android Apps. The /system partition is now mounted nosuid for zygote-spawned processes, preventing Android applications from executing setuid programs. This reduces root attack surface and the likelihood of potential security vulnerabilities.
  • Capability bounding. Android zygote and ADB now use prctl(PR_CAPBSET_DROP) to drop unnecessary capabilities prior to executing applications. This prevents Android applications and applications launched from the shell from acquiring privileged capabilities.
  • NO_NEW_PRIVS. Android zygote now uses prctl(PR_SET_NO_NEW_PRIVS) to block addition of new privileges prior to execution application code. This prevents Android applications from performing operations which can elevate privileges via execve. (This requires Linux kernel version 3.5 or greater).

Default SELinux context of /system/xbin/su is u:object_r:su_exec:s0 but it may not be the only constraint.

For more details see:

Also:

Improve this answer
-1

Impossible to say with that little information. You said:

...and ran chmod 6755 ./su, chown root:root ./su and chcon u:object_r:system_file:s0 ./su

This seem to imply you are already root. If it's SELinux problem, you shouldbe able to see this in logcat -b main *:V.

Improve this answer
3
  • I am root in the TWRP terminal, but not in Android.
    – nom
    May 22, 2017 at 16:36
  • What I am asking is, what should be the correct SELinux context for the program.
    – nom
    May 22, 2017 at 16:40
  • Also, please elaborate on what information you would require.
    – nom
    May 22, 2017 at 16:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .