I can get a root prompt in the terminal by running one exploits documented elsewhere. (e.g. here: http://wiki.cyanogenmod.com/wiki/Motorola_Droid_2_Global:_Full_Update_Guide)
At this point, I can install the "su" binary and give it permissions 4755. This should allow anyone to execute it, and since the owner of the binary is "root" and the sticky bit is set, I should become root. But I apparently have no way of un-become root from the terminal short of rebooting. But, after I reboot, then I can't seem to become root using 'su'.
$ ls -l /system/bin/su
-rwsr-xr-x root app_101 26234 2012-07-09 15:00 su
Ok, the permissions look fine, should I should be able to run it to become root, but only in this particular invocation of the terminal.
It also fails if i specify the command to run as root, or with any other arguments:
$ /system/bin/su /system/bin/sh
Why? Is there some other mechanism at work? I don't want to install Superuser.apk, because I just want a way that I can temporarily get a root shell if needed, for instance to delete unwanted files manually. Besides, Superuser.apk relies on the su binary anyway, so it must have some way of calling it, so why can't I replicate that in the terminal?
Edit: I had another thought, so I tried copying /bin/sh to another locattion and made it suid root. But while I can execute the new binary, it doesn't give me root. Is Android doing something tricky/different with suid that regular Linux does not do?