Elevated privileges in the application for Android

Question:

I need to run some commands that require higher privileges from the application on the root device. Say, for example, chmod 777 or access to a file whose permissions are --w------- (will work if the permissions were --w-----w- , which means that the application works as another group )

Additional information:

  • Running Android API 18 (no SELinux)

Things I've already tried:

1) Using su from java :

From this post, I tried using su in java, for example:

 Process su = null; try { su = Runtime.getRuntime().exec("su"); su.getOutputStream().write("chmod 777 file\n".getBytes()); su.getOutputStream().write("exit\n".getBytes()); su.waitFor(); } catch (Exception e) { e.printStackTrace(); } finally { if (su != null) { su.destroy(); } } 

An error does not occur, but it does nothing.

2) Using setWritable() from java :

 boolean ret = file.setWritable(true, false); 

Here ret = false indicates that it failed.

3) Using the RootTools library:

 Command cmd=new Command(0,"chmod 202 /sys/class/gpio/export"); try { RootShell.getShell(true).add(cmd); }catch(Exception e){ Log.d(TAG,e.getMessage()); } 

Running this gives me: Error! Permission denied Error! Permission denied

4) Using this answer

Using the ExecuteAsRootBase class, I get: Can't get root access or denied by user .

5) Placing the application in /system/app

Still works like u0_a38 for this reason for some reason! To make this work, I had to manually place the .so library under /system/libs . I also had to chmod 644 my .apk so that it could work. I do not understand why I do not fall under root, as when I use ls -l on my apk in /system/app , it gives me:

 -rw-r--r-- root root 1270817 2000-01-01 01:42 com.my.app.apk 

6) Signing the application as a system application (not in /system/app )

That was the last thing I tried.

Following these instructions, I was able to sign and install the application. I called ps from the adb shell to check if it works as root, only to find out that it works under u0_a38 .

Note : when installing as a system application, even after signing, I could not install the application with android:sharedUserId="android.uid.shared" , because it gave me: Failure [INSTALL_FAILED_SHARED_USER_INCOMPATIBLE] . Thus, an application signed as a system application skipped this line from the manifest.

7) Placing the signed system application in /system/app

Just like in 5 .

When I enter ls -l in /system/app , I get:

-rw------- root root 1303459 2000-01-01 01:02 com.my.app.apk

However, running the "id" from the application, I know that it actually works like:

 uid=10038(u0_a38) gid=10038(u0_a38) groups=1015(sdcard_rw),1028(sdcard_r),50038(all_a38) 

8) Setting android:sharedUserId="android.uid.system" regardless of the error

So even if I could not make this installation using adb install due to an error: Failure [INSTALL_FAILED_SHARED_USER_INCOMPATIBLE] , I went ahead and pulled the trigger anyway. I used adb push to get .apk in /system/app , and then manually added my own library to /system/libs , rebooting the device so that the system would delete it. Then I got this error while loading:

 W/PackageManager( 2652): Signature mismatch for shared user : SharedUserSetting{411d82d8 android.uid.system/1000} D/PackageManager( 2652): No files in app dir /vendor/app E/PackageManager( 2652): Package com.my.app has no signatures that match those in shared user android.uid.system; ignoring! 

So, I assume that there is a possibility that the keys provided by the manufacturer may not be correct . I found them here , which is a link from the manufacturerโ€™s website.

OR

This is a time ago, but not sure if it is still relevant. I hesitate to just delete this part of the file, but I will most likely end up trying it very soon. I do not see how uninstalling android.uid.***** from packages.xml will not affect applications already installed on the system.

Output:

Is there anything else that can be done besides rebuilding with new keys? Or is that almost all?

+6
source share
2 answers

I cannot comment, but I want to know which device / OS you are trying to execute. Some Android 4.4 versions have SELinux in Enforcing mode, which will prevent some of the operations that you seem to want to do. But if your device is rooted, no matter what it sounds, you can run su setenforce 0 on the command line, which puts SeLinux in resolution mode and hopefully solves your problem.

0
source

On my root device running Android 7.1.1, running su root setenforce 0 in the shell allows my application to perform an elevated privileged operation, such as rebooting.

0
source

All Articles