0

Preamble

My problem is, to run specific commands (i.e., start specific processes, possibly at background) on boot. I've installed Termux, so I want to start some of its commands at boot time, such as sshd and crond. For some reason, I don't want to use Termux:Boot application (mainly because it do things late).

I used a script written some time ago, which ables me to call a Termux command, running as the user which Termux shell itself starts as (so not to have problems with processes being run as root, and be able to access Termux commands, at the same time). It worked, however, there is a problem: The network access is denied.

How I found it is a permission denied problem, not something else?

Initially, let's say how I logined as the non-root Termux user. whoami gave me the Termux user name, which was u0_a73. As my phone was (and is) rooted, I could use su binary. So, I ran this:

$ su - u0_a73

Now, I should be able to run sshd command. No, it failed:

$ sshd
bad addr or host: <NULL> (No address associated with hostname)

Why? Focusing on most important parts, I ran ltrace and strace commands. To find what was going wrong, this command helped me a lot:

# # Find most syscalls exited with errors
# strace sshd 2>&1 | grep "= -1"

And resulted in:

openat(AT_FDCWD, "/data/data/com.termux/files/usr/lib/libc.so", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/data/data/com.termux/files/usr/lib/libnetd_client.so", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/data/data/com.termux/files/usr/lib/libc++.so", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/data/data/com.termux/files/usr/lib/libm.so", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 ENOENT (No such file or directory)
getrandom(..., ..., ...)            = -1 ENOSYS (Function not implemented)
socket(PF_INET6, SOCK_DGRAM|SOCK_CLOEXEC, IPPROTO_IP) = -1 EACCES (Permission denied)
socket(PF_INET, SOCK_DGRAM|SOCK_CLOEXEC, IPPROTO_IP) = -1 EACCES (Permission denied)

Duh! Look at the two last lines: Permission denied.

The Problem

Note: It important to note that the same problem does not exist with Termux shell itself, even with the same environment variables on both shells.

The problem is, I cannot connect to network devices, such as wlan0 (WiFi) and rmnet0 (Data). All commands that requests these accesses fails, like sshd, ifconfig, wget and ping.

So, after a lot of researching:

  • I've found this thread. It also provides an answer to the problem. However, there are no groupadd or usermod commands (or addgroup or moduser either) on my Android box, anywhere. See this question. It seems these commands may exist or not from device to device.

  • Due to the note at the beginning of the current section, after running id command on both shells, I realized that, Termux shell's user is added on extra groups than my custom su-initialized shell. The Termux shell u0_a73 user is on extra groups, including inet, everybody and all_a73.

    Note: Thanks for the helps, but please avoid saying "So you should add u0_a73 in your custom shell in these groups, particularly the inet one!". Seems impossible in my environment. Read the previous item; I have no command to do this (Why? IDK).

  • There's another room: Changing permissions (or possibly owners) of device files (or something else). While it should be considered as a temporary fix, as it might have security flaws, but, if you know how, then I'll appreciate you by an upvote (perhaps will not be my own answer).

I don't know if it helps or not, but when I use su provided by Termux and I run ifconfig inside, a bunch of these audit messages will be produced:

09-04 20:08:04.647 24951 24951 I ifconfig: type=1400 audit(0.0:2567): avc: denied { ioctl } for path="socket:[221195]" dev="sockfs" ino=221195 ioctlcmd=8912 scontext=u:r:magisk:s0 tcontext=u:r:magisk:s0 tclass=unix_dgram_socket permissive=1
09-04 20:08:04.647 24951 24951 W ifconfig: type=1300 audit(0.0:2567): arch=40000028 syscall=54 per=800008 success=yes exit=0 a0=3 a1=8912 a2=be83a738 a3=3 items=0 ppid=24888 auid=4294967295 uid=10073 gid=10073 euid=10073 suid=10073 fsuid=10073 egid=10073 sgid=10073 fsgid=10073 ses=4294967295 tty=pts19 exe="/data/data/com.termux/files/usr/bin/ifconfig" subj=u:r:magisk:s0 key=(null)

So, how to fix this permissions problem, that is, the system blocks a non-root user from accessing network devices?

I'm using Android (custom ROM, ViperOS) 7.1.2 (rooted), with Magisk installed, kernel 3.10.

Thanks in advance.

6
  • Your process must be in group AID_INET (GID: 3003) (or have the capability NET_RAW) to create network sockets. Sep 4, 2020 at 17:00
  • @IrfanLatif Please read first two items in "The Problem" section, again. There is a group named inet (3003), and I know if I'm in that group, the problem should be fixed. However, consider I have no way to do that; there's no addgroup or the like in my environment. Sep 4, 2020 at 17:04
  • Read the linked answer. You don't need addgroup to add your process to a group. You can use e.g. setpriv. If you want to stick with addgroup approach, see my answers to this and this. However it won't work the way you are trying to make it work. To know why, again, read the answer I linked first. Sep 4, 2020 at 17:09
  • @IrfanLatif OK, thanks for the links, really. As I have not enough time now, I'll check those tomorrow, and report it back. Sep 4, 2020 at 17:17
  • 1
    Well, Android disappoints those who expect it to be a usual Linux distro. It's not, and most probably never going to be. It uses the powers of Linux kernel, but userspace is entirely a different world. Androids provides no official tools, documentation, APIs or support to achieve what you want to do. We need to figure out some out-of -the-way solution. You can use this command to add sshd process to 3003 group: setpriv --reuid 10173 --regid 10173 --groups 3003 -- sshd. However if you run it from an app which holds INTERNET permission, all forked process are already in the said group. Sep 5, 2020 at 20:28

0

Browse other questions tagged .