Preamble
My problem is, to run specific commands (i.e., start specific processes, possibly at background) on boot. I've installed Termux, so I want to start some of its commands at boot time, such as sshd
and crond
. For some reason, I don't want to use Termux:Boot application (mainly because it do things late).
I used a script written some time ago, which ables me to call a Termux command, running as the user which Termux shell itself starts as (so not to have problems with processes being run as root, and be able to access Termux commands, at the same time). It worked, however, there is a problem: The network access is denied.
How I found it is a permission denied problem, not something else?
Initially, let's say how I logined as the non-root Termux user. whoami
gave me the Termux user name, which was u0_a73
. As my phone was (and is) rooted, I could use su
binary. So, I ran this:
$ su - u0_a73
Now, I should be able to run sshd
command. No, it failed:
$ sshd
bad addr or host: <NULL> (No address associated with hostname)
Why? Focusing on most important parts, I ran ltrace
and strace
commands. To find what was going wrong, this command helped me a lot:
# # Find most syscalls exited with errors
# strace sshd 2>&1 | grep "= -1"
And resulted in:
openat(AT_FDCWD, "/data/data/com.termux/files/usr/lib/libc.so", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/data/data/com.termux/files/usr/lib/libnetd_client.so", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/data/data/com.termux/files/usr/lib/libc++.so", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/data/data/com.termux/files/usr/lib/libm.so", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 ENOENT (No such file or directory)
getrandom(..., ..., ...) = -1 ENOSYS (Function not implemented)
socket(PF_INET6, SOCK_DGRAM|SOCK_CLOEXEC, IPPROTO_IP) = -1 EACCES (Permission denied)
socket(PF_INET, SOCK_DGRAM|SOCK_CLOEXEC, IPPROTO_IP) = -1 EACCES (Permission denied)
Duh! Look at the two last lines: Permission denied.
The Problem
Note: It important to note that the same problem does not exist with Termux shell itself, even with the same environment variables on both shells.
The problem is, I cannot connect to network devices, such as wlan0
(WiFi) and rmnet0
(Data). All commands that requests these accesses fails, like sshd
, ifconfig
, wget
and ping
.
So, after a lot of researching:
I've found this thread. It also provides an answer to the problem. However, there are no
groupadd
orusermod
commands (oraddgroup
ormoduser
either) on my Android box, anywhere. See this question. It seems these commands may exist or not from device to device.Due to the note at the beginning of the current section, after running
id
command on both shells, I realized that, Termux shell's user is added on extra groups than my customsu
-initialized shell. The Termux shellu0_a73
user is on extra groups, includinginet
,everybody
andall_a73
.Note: Thanks for the helps, but please avoid saying "So you should add
u0_a73
in your custom shell in these groups, particularly theinet
one!". Seems impossible in my environment. Read the previous item; I have no command to do this (Why? IDK).There's another room: Changing permissions (or possibly owners) of device files (or something else). While it should be considered as a temporary fix, as it might have security flaws, but, if you know how, then I'll appreciate you by an upvote (perhaps will not be my own answer).
I don't know if it helps or not, but when I use su
provided by Termux and I run ifconfig
inside, a bunch of these audit messages will be produced:
09-04 20:08:04.647 24951 24951 I ifconfig: type=1400 audit(0.0:2567): avc: denied { ioctl } for path="socket:[221195]" dev="sockfs" ino=221195 ioctlcmd=8912 scontext=u:r:magisk:s0 tcontext=u:r:magisk:s0 tclass=unix_dgram_socket permissive=1
09-04 20:08:04.647 24951 24951 W ifconfig: type=1300 audit(0.0:2567): arch=40000028 syscall=54 per=800008 success=yes exit=0 a0=3 a1=8912 a2=be83a738 a3=3 items=0 ppid=24888 auid=4294967295 uid=10073 gid=10073 euid=10073 suid=10073 fsuid=10073 egid=10073 sgid=10073 fsgid=10073 ses=4294967295 tty=pts19 exe="/data/data/com.termux/files/usr/bin/ifconfig" subj=u:r:magisk:s0 key=(null)
So, how to fix this permissions problem, that is, the system blocks a non-root user from accessing network devices?
I'm using Android (custom ROM, ViperOS) 7.1.2 (rooted), with Magisk installed, kernel 3.10.
Thanks in advance.
inet
(3003), and I know if I'm in that group, the problem should be fixed. However, consider I have no way to do that; there's noaddgroup
or the like in my environment.addgroup
to add your process to a group. You can use e.g.setpriv
. If you want to stick withaddgroup
approach, see my answers to this and this. However it won't work the way you are trying to make it work. To know why, again, read the answer I linked first.sshd
process to3003
group:setpriv --reuid 10173 --regid 10173 --groups 3003 -- sshd
. However if you run it from an app which holds INTERNET permission, all forked process are already in the said group.