After spending days on that topic I am in need of additional ideas ;)
Facts: MTK6757 / Android 7 / Kernel 4.4.15 / FS EXT4 (No F2FS) / Working Root
I have a fresh and clean 64MB EXT4 .IMG File in /data/adb. e2fsck agrees with that ;)
Problem: Mounting and/or writing to it via Loop Device fails.
What I have checked:
- Access rights of the file
- Access rights of the block device
- Access rights of the destination dir
- Manually created the block device
- Manually setup via losetup
- Played with all options
- SElinux Permissive / Enforcing
Behaviour:
It only gets mounted with "mount" because it calls a ioctl BLKROSET (thx strace)
Mount and
/proc/mountsshow RWAs soon as I write (mkdir) to it, it switches to RO (dmesg says Switching to RO cause of Buffer I/O error on dev loop0, logical block 0, lost sync page write)
When I enforce writing it gets written to cache but not to the file
ioctl /dev/block/loop0 0x125d 1 mkdir /sbin/.core/img/test
And now the strange part:
When the img file is on /sdcard it works.
The SE Context is of course different, but i also tried in Permissive.
When the mounting occurs BEFORE Zygote starts or in Recovery, writing fails also on /sdcard (Update: Because during boot /sdcard is not available yet)
Anybody any ideas?
Update:
It gets even more interesting:
Turns out writing to /sdcard only works as long as it is mounted as sdcardfs.
If sdcardfs is deactivated it gets mounted as FUSE properly, but writing doesnt work anymore.
As all the facts hint toward a selinux \ vold \ FS problem, i tried to restage the sdcardfs evironment.
Assign root \ sdcard_rwandu:object_r:sdcardfs:s0` to the file in a different directory.
Doesnt work ;(
Then I compared the selinux policies of 2 devices where it works with the problematic one.
Turns out allow vold block_device : blk_file { ioctl read write create getattr setattr lock append unlink rename open } is completely missing.
But injecting that doesn't help too...
Any experts or suggestions?
