49

Is there a way for me to run Adb shell as root without typing in su? I want to be able to have root access without going into the shell.

0

7 Answers 7

45

If I'm understanding your question correctly, you're asking how to get root access automatically when you run adb shell, so that you don't have to go into the shell and type su to execute a command as root on your phone.

This is controlled by a flag in your boot partition, which most custom ROMs have modified to allow root permission by default. If you get dropped to a $ when you use adb shell then you have two permanent options and one temporary one (temporary meaning that it doesn't stick if you reboot):

  1. Flash a ROM that includes the modification
  2. Create a custom boot.img and flash it to your phone
  3. Restart adbd on your device with root permissions

Number 2 is actually not that difficult, but it can be somewhat dangerous if you're careless. There is a wiki article here which explains the process and includes a couple of Perl scripts to help you. These instructions assume a Linux/Unix environment. I have personally used these instructions on Fedora Linux and can tell you that they work, but I do not know about other *nix environments like Macs. I also do not know of any similar Windows instructions, but I could try to track some down if you are on Windows. The exact commands will vary somewhat from phone to phone since different devices use different partition tables.

Generally speaking, though, you need to pull your current boot.img from your phone, unpack it, extract the ramdisk, and find the default.prop file. This is a plaintext file, which you need to open in a text editor and then find the line that contains the value ro.secure. If the line says ro.secure=1 then you need to change it to ro.secure=0. After that you can re-pack the ramdisk and boot.img, then flash it to your phone. Once you reboot, you will be greeted with a # prompt whenever you perform adb shell without having to run su.

Alternatively, if you are using a custom ROM but it doesn't have this modification, you can just unzip the ROM and modify the boot.img that is included with it using the above steps. Then you can zip up the ROM with the newly modified boot.img and flash the zip file as you normally would.

This probably goes without saying, but be careful when doing this. Messing with your boot partition can quite easily wreck your phone and force you to recover via HBoot. I would highly recommend testing Fastboot to makes sure you can use extended Fastboot commands and perform a recovery. This varies a bit based on your model, but most phones have some sort of desktop software that can be run to reflash the phone as well.


The third option is that in many cases it may be possible to restart adbd on your device with root privileges. One possibility is to execute adb root from a PC terminal, although this will not work on all ROM configurations (the ROM must be built as a "userdebug" one). You can also try Chainfire's adbd insecure app. This will not persist across a reboot, so you would need to use either the app or adb root again any time you restarted your phone.

7
  • Does the phone also boot with root permissions? Could be a security issue. Feb 12, 2011 at 4:26
  • 1
    @Matthew: AFAIK, it only allows adbd to have root permission on the phone by default. There's a post from a member of the Android team that implies this, but does not say it explicitly. This commit to the AOSP also implies that it is simply a flag that adbd checks on startup (I don't see it elsewhere in the source). As I mentioned, the majority of custom ROMs that I've seen (CM included) have it set to 0. Feb 12, 2011 at 6:23
  • I will say that I'm not 100% on the above, though. I can't find any official documentation related to the default.prop file, though perhaps my Google-fu is just weak tonight... Feb 12, 2011 at 6:24
  • Just discovered the adb root command to restart adbd in auto-su mode, apparently it relies on this. I do think you were right about it being just a flag, though. Jan 24, 2012 at 20:20
  • 1
    @MatthewRead: The source code in the commit I linked to actually has a comment to that effect :) // ... except we allow running as root in userdebug builds if the service.adb.root property has been set by the "adb root" command". Incidentally, that's how the first version of BurritoRoot for the Kindle Fire worked, IIRC. Jan 24, 2012 at 20:33
18

Well if you phone is rooted you can run commands with the "su -c" command.

Here is an example of a cat command on the build.prop file to get a phones product information.

adb shell "su -c 'cat /system/build.prop |grep "product"'"

This invokes root permission and runs the command inside the ' '

Notice the 5 end quotes, that is required that you close ALL your end quotes or you will get an error.

For clarification the format is like this.

adb shell "su -c '[your command goes here]'"

Make sure you enter the command EXACTLY the way that you normally would when running it in shell.

Give it a try, hope this helps.

1
  • For example you can use adb shell -t "su -c 'sh'" to run a shell as root. The -t is needed to get the prompt.
    – gam3
    Jan 18, 2020 at 21:04
2

Simply install adbd Insecure.

1

What are you trying to run as root for? You're saying that you want to run ADB shell with root but you don't want to use ADB shell? Can you clarify?

If the application requests for root access, then the SuperUser application on your phone should handle giving it permission or not. The process in which you rooted your phone should have included a SuperUser application.

4
  • I want to run adb shell gdbserver from my terminal instead of going into shell to run it
    – Hank
    Feb 11, 2011 at 19:10
  • 2
    @Hank: a terminal almost always need to be connected to a shell to do any useful work; perhaps you should clarify your definition of "terminal" and "shell" since you seems to have a different idea of what they were than in standard Linux/Android parlance
    – Lie Ryan
    Feb 11, 2011 at 19:24
  • so you can do adb shell ps or adb shell and then ps to get the running process list. So somethings require root access, I want to be able to do the former.
    – Hank
    Feb 11, 2011 at 19:38
  • 1
    The reason "why" (especially where gdbserver is concerned) would be to be able to use the capability in a script running on the development machine. However, it's possible for a script to pipe commands into what adb thinks of as an interactive shell, so having adb default to root really isn't necessary for that reason. May 15, 2011 at 7:53
1

As an alternative, you could write your script on the phone and simply have adb execute it, for example:

adb shell sh /sdcard/myscript.sh

The script can elevate itself without your intervention (assuming SuperUser is set to remember the approval), for example:

su
pm setInstallLocation 1

I just did this on my phone with success, the only problem being that I haven't quite figured out how to cleanly end the adb shell session. I have to Ctrl-C in my Windows shell to return to the Windows command prompt -- otherwise adb just sits at the # prompt and doesn't accept input.

0

You can also set the suid bit on your 'sh'. I'm using BusyBox so instructions may not match your setup:

  1. adb shell
  2. su
  3. mount -o remount,rw /system (or: adb remount)
  4. ls -la /system/bin/sh lrwxr-xr-x root shell 2012-11-10 15:20 sh -> mksh
  5. chmod 4755 /system/bin/sh
  6. ls -la /system/bin/mksh
    -rwsr-xr-x root shell 157520 2012-11-10 09:54 mksh (notice the suid bit is set)
  7. ^D
  8. adb shell

and you should have the root prompt

2
  • 4
    -1 from me. This is insecure and opens a huge hole. Any APP could become root and wreak havoc.
    – ce4
    Nov 27, 2012 at 10:32
  • 8
    Absolutely do not do that, this is a catastrophic security hole. (Disclaimer: I’m the mksh maintainer.)
    – mirabilos
    Mar 6, 2014 at 9:57
0

i use for repair home button issue failure


adb devices

adb shell su -c commands

or

adb root shell sqlite3 /data/data/com.android.providers.settings/databases/settings.db "INSERT INTO secure (name,value) VALUES ('device_provisioned','1');"

adb kill-server

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .