Note: Following solution requires a rooted device.
The only good thing Google did was to choose the flexible and configurable Linux kernel for Android, not going for something like a crippled kernel and trying to handle everything from userspace, including running a Linux kernel (1).
Linux kernel's Audit System makes it possible to log any system calls or filesystem changes made by a process. In our case we need to identify the process(es) which are writing to
/system and making syscalls
Linux distributions have a service auditd which communicates with kernel to get information about security-related events. On Android we have already
logd, not as configurable as
auditd but enough for basic monitoring.
logd mainly covers the functionality of its desktop counterpart syslogd, but also includes klogd and partially auditd to get logs from SELinux subsystem of kernel.
We can add a few more rules using auditctl to also report events we are interested in. You can use
auditctl from a minimal Linux environment on your Android device, or compile the binary from source code (should be built with --with-arm / --with-aarch64 whatever your devices' architecture is), or get one pre-compiled here.
Now create rules files in
/etc or wherever you want to:
# enable auditing, won't work in PID namespace
# won't work if permanently disabled with kernel parameter "audit=0"
# delete previous rules (though there are none on Android)
# increase the buffers to avoid failure
# no. of event to be queued, waiting for logd to read them
# disable rate limit (msgs/sec) to avoid failure
# this determines how long to wait in burst of events
# set failure mode to dmesg
# define filesystem rules, whatever file/directory you want to watch
-w /system -p wa -k FILESYSTEM_AUDIT
# define syscall rules, see all syscalls with 'ausyscall --dump' or
# here: github.com/linux-audit/audit-userspace/blob/master/lib/aarch64_table.h
-a always,exit -S fchmod -S fchmodat -k CHMOD_AUDIT
-a always,exit -S mount -k MOUNT_AUDIT
# clear on exit, restore Android default values
~# auditctl -R /etc/audit-start.rules
Now make changes; mount
/system R/W, write/delete something there and change file permissions.
logd configuration, you can get
audit log in one or more of different logs (2) including
events buffer (3) of
main buffer (4):
~# logcat -d -b events,main | grep _AUDIT
Or in kernel's
printk buffer (5) and
kernel buffer (6):
~# dmesg | grep _AUDIT
~# logcat -d -b kernel | grep _AUDIT
audit(0.0:16122): arch=c00000b7 syscall=40 success=yes exit=0 a0=7fcec5db38 a1=7fcec5db3f a2=0 a3=8021 items=1 ppid=761 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="busybox" exe="/data/data/com.mixplorer/files/busybox/busybox" subj=u:r:magisk:s0 key="MOUNT_AUDIT"
audit(0.0:16126): arch=c00000b7 syscall=53 success=yes exit=0 a0=ffffff9c a1=7b839180c0 a2=81a4 a3=0 items=1 ppid=11687 auid=4294967295 uid=10135 gid=10135 euid=10135 suid=10135 fsuid=10135 egid=10135 sgid=10135 fsgid=10135 tty=(none) ses=4294967295 comm="Thread-7" exe="/system/bin/app_process64" subj=u:r:untrusted_app:s0:c135,c256,c512,c768 key="CHMOD_AUDIT"
audit(0.0:16141): arch=c00000b7 syscall=35 success=yes exit=0 a0=ffffff9c a1=7bc22a3c40 a2=0 a3=7bdfbd3098 items=2 ppid=11687 auid=4294967295 uid=10135 gid=10135 euid=10135 suid=10135 fsuid=10135 egid=10135 sgid=10135 fsgid=10135 tty=(none) ses=4294967295 comm="pool-2-thread-1" exe="/system/bin/app_process64" subj=u:r:untrusted_app:s0:c135,c256,c512,c768 key="FILESYSTEM_AUDIT"
First line shows that some process running as root with Magisk's SELinux context has made syscall
mount) and the command shows it's MiXplorer app (just as example, I did that myself).
Second line indicates that the app running with UID
Third line shows the same app (by making syscall
35) deleted something in
This is a simple use case. More recursive rules can be defined to deal with complex situations, interpreting other fields of log as well, as explained here.
To clear rules:
~# auditctl -R /etc/audit-stop.rules
- For simple cases where the objective is just to get notified of some filesystem changes (and not to trace the originator),
inotify API can be used instead as explained in this answer.
- In order to mark all the processes that run before the audit starts auditable by kernel, pass
audit=1 boot parameter to kernel, either by editing
boot.img or use
fastboot -c option.
To save audit log to a file, run
logcat in background:
logcat -s auditd -b events -f /data/media/0/auditd.log &