My problem is theoretical at this moment. I am investigating if it is possible or not, before spending hours on it.

  • I have a rooted phone.
  • I want to add an entry to the IPTABLES on startup.
  • If the phone is factory reset, I still want the entry to be added to IPTABLES.

My thought so far are:

  1. Altering the boot image and making the init.rc permanent, but I think that is to scary and risky.
  2. Create an app (apk) that is installed in /system/app that runs the ITPABLES command.

What are my chances of succeeding with number 2?

To run IPTABLES the apk needs root, the phone is rooted, but does the app have root access just because it is in /system/app? Normal apps trigger SuperSU to grant the app root, but I want it to do the IPTABLES thing without any popups. All unattended.


Your chances for #2 are pretty good – though there might be some caveats. To figure which those are, let's take a look of what a does. It...

  • wipes /data
  • wipes /cache
  • wipes the cache (usually implicitly, as in most cases this resides in /data; I guess with Lollipop it will do the same for ART).

So you see, /system remains untouched. With your app installed in /system/app, it will survice a factory-reset. But its data might not, as /data gets wiped. Which means, all required settings need to be part of the app itself, or of its "default settings" which get deployed on first initalization.

For the second part: That's better asked at a development site (which we are not). Basically, no app gets root access by default AFAIK. They get access to everything their permissions allows (and yes, there are permissions which can be granted to system apps which are not available to "user-space apps") – but for root access, you've got to ask su, which should trigger the corresponding superuser app.

PS: As for the SuperSU popup, you will have to live with that for the first call, I'm afraid.

  • Thanks. Guess you right. Read more about SU and looks like the whole design is to prevent unless user says different. I tested one thing that might be promising. I disabled SU started a terminal window, tested to do something that requires root, I was denied. But I could start telnetd through busybox. The telnet session was root user... wierd. But in the telnet session I could do what I want. – Magnus Nov 25 '14 at 20:04
  • Exactly. Otherwise malicious apps could abuse that, hence user interaction is required. Glad I was able to help! – Izzy Nov 25 '14 at 20:11

There are apps that survive a factory reset, the most well known being Cerberus. You install it as a system app via recovery and after that it survives basically anything. After a factory reset, it is still able to do things like make pictures, track location etc. So I would say what you are trying to achieve must certanly be possible. I'm not a dev though, so I can't show you exactly how to do ot.

  • Yes, tru, but Cerberus and AndroidLost have a server they can get their settings from using the phone IMEI as key, and they work on unrooted phones too. Apps like firewalls etc would do the trick for me as well, but unfortunately they loose their settings on factory reset and start as disabled AND actively ask for root access. – Magnus Nov 25 '14 at 14:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.