Hi everyone (and sorry, can't post proper links yet),
I'm a security/pentester looking for a generic way of circumventing root detection. Only thing I'm usually interested is to have full filesystem access (check how apps encrypt their data), start a couple of execs with root (eg. frida-server) and have a root shell in general. I have a Nexus 5 "hammerhead", installed full stock image MOB30Y, then checked the kernel and downloaded the kernel source code for the matchin 3.4.0-gcef4f17. I added a backdoor to the kernel code, similar to this backdoor: github.com/allwinner-zh/linux-3.4-sunxi/blob/bd5637f7297c6abf78f93b31fc1dd33f2c1a9f76/arch/arm/mach-sunxi/sunxi-debug.c#L41 , then recompiled the kernel, and booted the device with that kernel. So far so good:
Code:
[email protected]:/ $ id
uid=2000(shell) gid=2000(shell) groups=2000(shell),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats) context=u:r:shell:s0
*trigger the backdoor*
Code:
[email protected]:/ $ id
uid=0(root) gid=0(root) groups=0(root),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats) context=u:r:shell:s0
So I'm uid 0 now. Now I just need to get around the SELinux mess. Problem:
Code:
[email protected]erhead:/data/data $ ls /data/data
opendir failed, Permission denied
My question: Anybody knows how I can call functions from android.googlesource.com/platform/external/libselinux/+/jb-mr1-dev-plus-aosp/include/selinux/selinux.h so I get the init context?
I'm not too familiar with these calls.... I think something along:
Code:
#include <selinux/selinux.h>
if is_selinux_enabled(){
struct security_context_t *cont;
getcon(cont); //This should get the kernel's context
//How do I assign the kernel's context to the "current" process context?
//?
freecon(cont);
}
Related
how can I solve that problem?
I write the code in init.rc:
Code:
mv /com.anddoes.launcher_preferences.xml /data/data/com.anddoes.launcher/shared_prefs/
it returns such error:
<3>[ 0.640121] init: /init.rc: 351: invalid command 'mv'
I tried both to write a script and to move toolbox with mv to the system root, but it returns the same error.
All the necessary folders exist
MaxiManBW said:
how can I solve that problem?
I write the code in init.rc:
Code:
mv /com.anddoes.launcher_preferences.xml /data/data/com.anddoes.launcher/shared_prefs/
it returns such error:
<3>[ 0.640121] init: /init.rc: 351: invalid command 'mv'
I tried both to write a script and to move toolbox with mv to the system root, but it returns the same error.
All the necessary folders exist
Click to expand...
Click to collapse
init.rc is not a shell script, but a command language for the init process. Use can use the "exec" command to execute the mv command, see the docs below. Remember to use full paths.
Code:
Android Init Language
---------------------
The Android Init Language consists of four broad classes of statements,
which are Actions, Commands, Services, and Options.
All of these are line-oriented, consisting of tokens separated by
whitespace. The c-style backslash escapes may be used to insert
whitespace into a token. Double quotes may also be used to prevent
whitespace from breaking text into multiple tokens. The backslash,
when it is the last character on a line, may be used for line-folding.
Lines which start with a # (leading whitespace allowed) are comments.
Actions and Services implicitly declare a new section. All commands
or options belong to the section most recently declared. Commands
or options before the first section are ignored.
Actions and Services have unique names. If a second Action or Service
is declared with the same name as an existing one, it is ignored as
an error. (??? should we override instead)
Actions
-------
Actions are named sequences of commands. Actions have a trigger which
is used to determine when the action should occur. When an event
occurs which matches an action's trigger, that action is added to
the tail of a to-be-executed queue (unless it is already on the
queue).
Each action in the queue is dequeued in sequence and each command in
that action is executed in sequence. Init handles other activities
(device creation/destruction, property setting, process restarting)
"between" the execution of the commands in activities.
Actions take the form of:
on <trigger>
<command>
<command>
<command>
Services
--------
Services are programs which init launches and (optionally) restarts
when they exit. Services take the form of:
service <name> <pathname> [ <argument> ]*
<option>
<option>
...
Options
-------
Options are modifiers to services. They affect how and when init
runs the service.
critical
This is a device-critical service. If it exits more than four times in
four minutes, the device will reboot into recovery mode.
disabled
This service will not automatically start with its class.
It must be explicitly started by name.
setenv <name> <value>
Set the environment variable <name> to <value> in the launched process.
socket <name> <type> <perm> [ <user> [ <group> ] ]
Create a unix domain socket named /dev/socket/<name> and pass
its fd to the launched process. <type> must be "dgram", "stream" or "seqpacket".
User and group default to 0.
user <username>
Change to username before exec'ing this service.
Currently defaults to root. (??? probably should default to nobody)
Currently, if your process requires linux capabilities then you cannot use
this command. You must instead request the capabilities in-process while
still root, and then drop to your desired uid.
group <groupname> [ <groupname> ]*
Change to groupname before exec'ing this service. Additional
groupnames beyond the (required) first one are used to set the
supplemental groups of the process (via setgroups()).
Currently defaults to root. (??? probably should default to nobody)
oneshot
Do not restart the service when it exits.
class <name>
Specify a class name for the service. All services in a
named class may be started or stopped together. A service
is in the class "default" if one is not specified via the
class option.
onrestart
Execute a Command (see below) when service restarts.
Triggers
--------
Triggers are strings which can be used to match certain kinds
of events and used to cause an action to occur.
boot
This is the first trigger that will occur when init starts
(after /init.conf is loaded)
<name>=<value>
Triggers of this form occur when the property <name> is set
to the specific value <value>.
device-added-<path>
device-removed-<path>
Triggers of these forms occur when a device node is added
or removed.
service-exited-<name>
Triggers of this form occur when the specified service exits.
Commands
--------
exec <path> [ <argument> ]*
Fork and execute a program (<path>). This will block until
the program completes execution. It is best to avoid exec
as unlike the builtin commands, it runs the risk of getting
init "stuck". (??? maybe there should be a timeout?)
export <name> <value>
Set the environment variable <name> equal to <value> in the
global environment (which will be inherited by all processes
started after this command is executed)
ifup <interface>
Bring the network interface <interface> online.
import <filename>
Parse an init config file, extending the current configuration.
hostname <name>
Set the host name.
chdir <directory>
Change working directory.
chmod <octal-mode> <path>
Change file access permissions.
chown <owner> <group> <path>
Change file owner and group.
chroot <directory>
Change process root directory.
class_start <serviceclass>
Start all services of the specified class if they are
not already running.
class_stop <serviceclass>
Stop all services of the specified class if they are
currently running.
domainname <name>
Set the domain name.
insmod <path>
Install the module at <path>
mkdir <path> [mode] [owner] [group]
Create a directory at <path>, optionally with the given mode, owner, and
group. If not provided, the directory is created with permissions 755 and
owned by the root user and root group.
mount <type> <device> <dir> [ <mountoption> ]*
Attempt to mount the named device at the directory <dir>
<device> may be of the form [email protected] to specify a mtd block
device by name.
<mountoption>s include "ro", "rw", "remount", "noatime", ...
setkey
TBD
setprop <name> <value>
Set system property <name> to <value>.
setrlimit <resource> <cur> <max>
Set the rlimit for a resource.
start <service>
Start a service running if it is not already running.
stop <service>
Stop a service from running if it is currently running.
symlink <target> <path>
Create a symbolic link at <path> with the value <target>
sysclktz <mins_west_of_gmt>
Set the system clock base (0 if system clock ticks in GMT)
trigger <event>
Trigger an event. Used to queue an action from another
action.
write <path> <string> [ <string> ]*
Open the file at <path> and write one or more strings
to it with write(2)
Properties
----------
Init updates some system properties to provide some insight into
what it's doing:
init.action
Equal to the name of the action currently being executed or "" if none
init.command
Equal to the command being executed or "" if none.
init.svc.<name>
State of a named service ("stopped", "running", "restarting")
Example init.conf
-----------------
# not complete -- just providing some examples of usage
#
on boot
export PATH /sbin:/system/sbin:/system/bin
export LD_LIBRARY_PATH /system/lib
mkdir /dev
mkdir /proc
mkdir /sys
mount tmpfs tmpfs /dev
mkdir /dev/pts
mkdir /dev/socket
mount devpts devpts /dev/pts
mount proc proc /proc
mount sysfs sysfs /sys
write /proc/cpu/alignment 4
ifup lo
hostname localhost
domainname localhost
mount yaffs2 [email protected] /system
mount yaffs2 [email protected] /data
import /system/etc/init.conf
class_start default
service adbd /sbin/adbd
user adb
group adb
service usbd /system/bin/usbd -r
user usbd
group usbd
socket usbd 666
service zygote /system/bin/app_process -Xzygote /system/bin --zygote
socket zygote 666
service runtime /system/bin/runtime
user system
group system
on device-added-/dev/compass
start akmd
on device-removed-/dev/compass
stop akmd
service akmd /sbin/akmd
disabled
user akmd
group akmd
Debugging notes
---------------
By default, programs executed by init will drop stdout and stderr into
/dev/null. To help with debugging, you can execute your program via the
Andoird program logwrapper. This will redirect stdout/stderr into the
Android logging system (accessed via logcat).
For example
service akmd /system/bin/logwrapper /sbin/akmd
kuisma said:
init.rc is not a shell script, but a command language for the init process. Use can use the "exec" command to execute the mv command, see the docs below. Remember to use full paths.
Code:
Android Init Language
---------------------
The Android Init Language consists of four broad classes of statements,
which are Actions, Commands, Services, and Options.
All of these are line-oriented, consisting of tokens separated by
whitespace. The c-style backslash escapes may be used to insert
...........................................
Click to expand...
Click to collapse
I created script and put it to /system folder
Then call it with:
Code:
service my_script /system/my_script.sh
class main
oneshot
and again received an error: <3>[ 61.921627] init: cannot find '/system/my_script.sh', disabling 'my_script'
MaxiManBW said:
I created script and put it to /system folder
Then call it with:
Code:
service my_script /system/my_script.sh
class main
oneshot
and again received an error: <3>[ 61.921627] init: cannot find '/system/my_script.sh', disabling 'my_script'
Click to expand...
Click to collapse
Is you script executable and begins with the line "#!/system/bin/sh"?
kuisma said:
Is you script executable and begins with the line "#!/system/bin/sh"?
Click to expand...
Click to collapse
Yes!
just in case, I used chmod 777 and first line begins with the line "#!/system/bin/sh".
Error no longer appears, but script doesn't work:
Code:
#!/system/bin/sh
if [-a /com.anddoes.launcher_preferences.xml]
cp /com.anddoes.launcher_preferences.xml /data/data/com.anddoes.launcher/shared_prefs/
rm /com.anddoes.launcher_preferences.xml
fi
I may be wrong calling service?
Code:
service my_script /system/my_script.sh
class main
oneshot
MaxiManBW said:
Yes!
just in case, I used chmod 777 and first line begins with the line "#!/system/bin/sh".
Error no longer appears, but script doesn't work:
Code:
#!/system/bin/sh
if [-a /com.anddoes.launcher_preferences.xml]
cp /com.anddoes.launcher_preferences.xml /data/data/com.anddoes.launcher/shared_prefs/
rm /com.anddoes.launcher_preferences.xml
fi
I may be wrong calling service?
Code:
service my_script /system/my_script.sh
class main
oneshot
Click to expand...
Click to collapse
I guess cp works, but not rm? Root is remounted read-only quite early in init.rc
Edit: Also, I've told you to use full paths. And that if-syntax...? It's sure not standard shell test syntax.
MaxiManBW said:
how can I solve that problem?
I write the code in init.rc:
Code:
mv /com.anddoes.launcher_preferences.xml /data/data/com.anddoes.launcher/shared_prefs/
it returns such error:
<3>[ 0.640121] init: /init.rc: 351: invalid command 'mv'
I tried both to write a script and to move toolbox with mv to the system root, but it returns the same error.
All the necessary folders exist
Click to expand...
Click to collapse
Did it work?
I think init.rc only understands absolute paths... I mean, replacing mv with the below might work.
/system/bin/mv XXX YYY
-pradeep.
---------- Post added at 03:41 PM ---------- Previous post was at 03:16 PM ----------
kuisma said:
I guess cp works, but not rm? Root is remounted read-only quite early in init.rc
Edit: Also, I've told you to use full paths. And that if-syntax...? It's sure not standard shell test syntax.
Click to expand...
Click to collapse
I have a similar question regarding init.rc.
I am trying to run a native application (which downloads the wifi firmware to dongle). I need this to be done before the wifi driver module is insmod'ed. Accordingly, I have an entry in init.rc with 'exec' command to run it -- at the end of "on init" section.
exec /system/bin/downloader -n /system/etc/wifi/xyz.nvm /system/etc/wifi/fake.trx
This command doesn't seem to run although I don't see any errors in the boot log.
I also tried a combination of 'service' commands like:
service downloader /system/bin/downloader -n /system/etc/wifi/xyz.nvm /system/etc/wifi/fake.trx
disabled
oneshot
Same result: no error in the bootlog but firmware not downloaded.
Any idea what might be wrong with the commands here? I am on JB-MR1.
-pradeep.
Gurumath said:
Did it work?
I think init.rc only understands absolute paths... I mean, replacing mv with the below might work.
/system/bin/mv XXX YYY
-pradeep.
---------- Post added at 03:41 PM ---------- Previous post was at 03:16 PM ----------
I have a similar question regarding init.rc.
I am trying to run a native application (which downloads the wifi firmware to dongle). I need this to be done before the wifi driver module is insmod'ed. Accordingly, I have an entry in init.rc with 'exec' command to run it -- at the end of "on init" section.
exec /system/bin/downloader -n /system/etc/wifi/xyz.nvm /system/etc/wifi/fake.trx
This command doesn't seem to run although I don't see any errors in the boot log.
I also tried a combination of 'service' commands like:
service downloader /system/bin/downloader -n /system/etc/wifi/xyz.nvm /system/etc/wifi/fake.trx
disabled
oneshot
Same result: no error in the bootlog but firmware not downloaded.
Any idea what might be wrong with the commands here? I am on JB-MR1.
-pradeep.
Click to expand...
Click to collapse
So here is the thing I read somewhere that exec are just added for show and they don't actually work
I am not entirely sure of the above statement, but what I am sure of is that you can write a script and add it to the init.rc to get your work done
---------- Post added at 10:26 AM ---------- Previous post was at 10:16 AM ----------
kuisma said:
I guess cp works, but not rm? Root is remounted read-only quite early in init.rc
Edit: Also, I've told you to use full paths. And that if-syntax...? It's sure not standard shell test syntax.
Click to expand...
Click to collapse
It is not about the wrong service being called.
It is the fact that the service has been defined but you need to call the service at some instant by adding the command
'start yourServiceName'
That is if you want to start your service at boot time, you will need to add the following lines
on property:sys.boot_completed=1
start my_script
Here is a full version of a script that I wrote, this was to toggle wifi at regular interval of time
My Shell Script - init.custom.sh
#!/system/bin/sh
while true; do
svc wifi disable
sleep 10
svc wifi enable
sleep 60
done
My Code inside init.rc
service custom /system/bin/init.custom.sh
user root
oneshot
on property:sys.boot_completed=1
write /sys/block/mmcblk0/queue/scheduler cfq ## This was already present
start custom
I know this is a very late reply, but I started exploring these things recently.
Hope this helps someone.
Hey XDA, long time listener first time caller.
I have an A200 rooted stock and am trying to boot Debian (or any other distro) on it.
I am a seasoned android dev, but new to linux in general. (yes i am aware that android is linux)
i am using the complete linux installer apk and extracting with archidroid. My path is /sdcard/debian/debian.img
i use the boot widget included and the following is my terminal output. i have been unable to find a solution and was hoping someone here would have some suggestions
[email protected]:/ $
[email protected]:/ $ cd sdcard/debian
[email protected]:/ $ /sdcard/debian $ su
[email protected]:/ $ /mnt/sdcard/debian # sh /data/data/com.zpwebsites.linuxonandroid/files/bootscript.sh sdcard/debian/debian.img
/data/data/com.zpwebsites.linuxonandroid/files/bootscript.sh[34]: dirname: not found
/data/data/com.zpwebsites.linuxonandroid/files/bootscript.sh[56]: dirname: not found
/data/data/com.zpwebsites.linuxonandroid/files/bootscript.sh[56]: dirname: not found
Checking loop device... FOUND
/data/data/com.zpwebsites.linuxonandroid/files/bootscript.sh[122]: /data/data/com.zpwebsites.linuxonandroid/files/busybox: cannot execute - Permission denied **<could this be a perms issue?**
Error: Unable to attach image to loop device! (Image = /sdcard/debian/debian.img)
1|[email protected]:/mnt/sdcard/debian #
EDIT** answered my own question. had to chmod /data/datacom...../busybox to 755 *********
Hi, I have made cron work on my 7" china tablet, it runs almost like I'd like it to..
I've made a passwd file in /etc with the following contents:
Code:
root:x:0:0::/data/cron:/system/bin/bash
I've made a symlink from /system/bin to /bin
And I've made a crontab file with the following line in it:
Code:
* * * * * /system/xbin/cat /sys/class/power_supply/battery/capacity > /dev/ttyACM0
Now the problem.. Cron runs fine, running the small bash code every minute, but..
ttyACM0 is a serial line to a microController - but the problem is that nothing is received on the controller, despite the cron running the script.
now if I LS /dev/tty* I get the following:
Code:
[email protected]:/ # ls /dev/ttyA* -l
ls /dev/ttyA* -l
crw------- root root 166, 0 2013-09-07 13:11 ttyACM0
-rw-rw-rw- root root 3 2013-09-07 13:14 ttyACM0
[email protected]:/ #
The cron creates an identical file in /dev and write it's data to this file, and not the *real* ttyACM0 serial..
I start the crond service in init.rc like this:
Code:
service crond /system/xbin/crond -c /data/cron
user root
disabled
oneshot
on property:dev.bootcomplete=1
.
.
start crond
If I change the cronscript to output to a flat file somewhere else (like /data/test_output), I can see the file with LS, but I'm not able to delete it nor cat it.
What's going on?
I need this to work in order to trigger a charger once the battery goes too low, and turn it off again once it has reached a given threshold. Not being able to send a simple command via serial really offsides this project.
Please help
Could it be that the cron job starts before the /dev/ttyACM0 is created?
hmm, I'll try and delay it a bit..
Made a simple check for if the device exists or not. if [ -c /dev/ttyACM0 ]This solves the problem.
I have a rooted a GT-I9195 (SGS4-mini) done with CF-Auto-Root and the latest Busybox. I then decided to use the "Ssh server" from The Olive Tree, since it is simple, small, free, but unfortunately have ads. For on-device/local shell, I use the Android Terminal Emulator and everything works great, including su and shell environment.
However, I have a really strange bahaviour when connecting using ssh via WiFi, and trying to su.
First when connecting via ssh, I get the following message.
Code:
[SIZE=2]$ ssh -2 -4 -t [email protected] -p 50555
Authenticated with partial success.
[email protected]'s password:
/system/bin/sh: No controlling tty: open /dev/tty: No such device or address
/system/bin/sh: can't find tty fd
/system/bin/sh: warning: won't have full job control
[email protected]:/ $[/SIZE]
I have Googled this and there's little useful info. On one site they even say:
Code:
[SIZE=2]Getting a controlling tty
[B]How does one get a controlling terminal? [COLOR=Red]Nobody knows[/COLOR], this is a great mystery.[/B]
The System V approach is that the first tty opened by the process
becomes its controlling tty. The BSD approach is that one has to
explicitly call
ioctl(fd, TIOCSCTTY, ...);
to get a controlling tty.
Linux tries to be compatible with both, as always, and this results in
a very obscure complex of conditions. Roughly:
The [B]TIOCSCTTY [/B]ioctl will give us a controlling tty, provided that (i)
the current process is a session leader, and (ii) it does not yet have
a controlling tty, and (iii) maybe the tty should not already control
some other session; if it does it is an error if we aren't root, or we
steal the tty if we are all-powerful.
Opening some terminal will give us a controlling tty, provided that
(i) the current process is a session leader, and (ii) it does not yet
have a controlling tty, and (iii) the tty does not already control
some other session, and (iv) the open did not have the [B]O_NOCTTY[/B] flag,
and (v) the tty is not the foreground VT, and (vi) the tty is not the
console, and (vii) maybe the tty should not be master or slave pty.
[/SIZE]
Now this is not the end of the world, if it was not that it doesn't understand normal terminal control characters and in addition, when I do su, I loose the command prompt. However, using the "-i" (interactive) switch gets me the "#" prompt, but environment is still completely messed up:
Code:
[SIZE=2][email protected]:/ $ [B]su -c /system/bin/sh -i[/B]
/system/bin/sh: No controlling tty: open /dev/tty: No such device or address
/system/bin/sh: can't find tty fd
/system/bin/sh: warning: won't have full job control
[email protected]:/ #[/SIZE]
I've never had or seen this issue before. Any ideas?
(Also, where would I put a source to my .bashrc and make sure it runs when su'ing or ssh?)
PS. The phone is using a stock 4.2.2 SELinux kernel.
Code:
[SIZE=2]Device: Samsung Galaxy S4 Mini LTE (GT-I9195)
Board/Platform: MSM8930AB (Snapdragon 400)
Baseband: I9195XXUBML4
Kernel: 3.4.0-2340422
[email protected] #1
Build: JDQ39.I9195XXUBML4
SE: SEPF_GT-I9195_4.2.2_0022
ro.build.date: Sat Dec 21 01:46:00 KST 2013
ro.build.description: serranoltexx-user 4.2.2 JDQ39 I9195XXUBML4
[/SIZE]
I still have no idea of what's causing those error messages above, also because logcat is not telling us anything interesting either. Only as Warning from "System.err", but without any useful information. However, I have got some improvement in the terminal behavior when doing the initial ssh connection.
One problem seem to be that the TERM environment variable was copied from local machine (PC side) to remote server (Android phone), thus giving TERM=cygwin to the Android shell. This can be disabled or changed as follows.
Some relevant SSH options:
Code:
[SIZE=2]
-e escape_char
Sets the escape character for sessions with a pty (default: `~'). The escape
character is only recognized at the beginning of a line. The escape charac-
ter followed by a dot (`.') closes the connection; followed by control-Z sus-
pends the connection; and followed by itself sends the escape character once.
Setting the character to "none" disables any escapes and makes the session
fully transparent.
-T Disable pseudo-tty allocation.
-t Force pseudo-tty allocation. This can be used to execute arbitrary screen-
based programs on a remote machine, which can be very useful, e.g. when
implementing menu services. Multiple -t options force tty allocation, even
if ssh has no local tty.
[/SIZE]
Some relevant SSH -o options:
Code:
[SIZE=2][B]RequestTTY[/B]
Specifies whether to request a pseudo-tty for the session. The argument may
be one of: "no" (never request a TTY), "yes" (always request a TTY when stan-
dard input is a TTY), "force" (always request a TTY) or "auto" (request a TTY
when opening a login session). This option mirrors the -t and -T flags for
ssh(1).
[B]
SendEnv[/B]
Specifies what variables from the local environ(7) should be sent to the
server. Note that environment passing is only supported for protocol 2. The
server must also support it, and the server must be configured to accept
these environment variables. Refer to AcceptEnv in sshd_config(5) for how to
configure the server. Variables are specified by name, which may contain
wildcard characters. Multiple environment variables may be separated by
whitespace or spread across multiple SendEnv directives. The default is not
to send any environment variables.
[/SIZE]
So by using the ssh -T option (which is equivalent to using '-o RequestTTY="no"'), we are disabling "pseudo-tty allocation" which doesn't work anyway, but with the effect of not forwarding local TERM to server, and thus setting it to default "vt100" which accepts backspace (but not insert). But a better way is to actually set the TERM variable on our own. This is done by simply adding it as a prefix to the ssh command like this:
Code:
[SIZE=2]TERM=[B]vt220[/B] ssh -t [email protected] -p 50555[/SIZE]
(This effectively, but temporarily overrides the local TERM value and forwards it to remote server shell.)
RanTime!
Since Google intruduced the SELinux/SEAndroid features, they have essentially fukced up the entire AOS ecosystem as based on good-old normal Linux environments and all the years of standards therein. Basically nothing works as before and as logically intended or preferred and I bet from now on, developers will have to spend a significant and expensive time, on just trying to setup their various developer environments and jump through the hoops of dikchead Google engineers, rather than on actual developing. A very sad story all thanks to the populist "security" eye-candy marketing.
The SU time!
Apparently after having read about the various quirks and issues in using an SELinux Enforced based AOS {4}, it seem that the issue from OP is probably due to one of 3 things or a combination thereof.
My su binary (SuperSU 1.94) is not yet handling SElinux properly
The SSHd server is not handling SELinux properly
Lack of properly set SSH and SHELL environment files on the server side
As for (1) I just have to wait and see. For (2) we can only test with other SSHd servers/solutions which I don't know what to use. (They're all, either not free or full of ads. WTF!) And finally, for (3) we can only test, since I don't have the source code...
Unfortunately listing the SuperSU (1.94) command line options is not very helpful, since they're rather poorly explained. While some of the option themselves just doesn't work (for me). It would have been great if @Chainfire could write a more detailed how-to {2} for all these options, but then again we should be extremely grateful he's written anything at all.
Code:
[SIZE=2]Usage: su [options] [--] [-] [LOGIN] [--] [args...]
------------------------------------------------------------------------------------
Options:
-c, --command COMMAND pass COMMAND to the invoked shell
-cn, --context CONTEXT switch to SELinux CONTEXT before invoking
-h, --help display this help message and exit
-, -l, --login pretend the shell to be a login shell
-m, -p,
-mm, --mount-master connect to a shell that can manipulate the
master mount namespace - requires su to be
running as daemon, must be first parameter
--preserve-environment do not change environment variables
-s, --shell SHELL use SHELL instead of the default detected shell
-v, --version display public version and exit
-V display internal version and exit
Usage#2: su LOGIN COMMAND...
Usage#3: su {-d|--daemon|-ad|--auto-daemon|-r|--reload}
auto version starts daemon only on SDK >= 18 or
if SELinux is set to enforcing
Usage#4: su {-i|--install|-u|--uninstall}
perform post-install / pre-uninstall maintenance
[/SIZE]
References:
[1] [Chainfire G+] Next Android version: even more breakage
[2] [Chainfire] How-To SU (Guidelines for problem-free su usage)
[3] SuperSU Download
[4] [Google] Validating Security-Enhanced Linux in Android
From THIS very old post by @mirabilos , it is possible that command-line TAB-completion and up-arrow is not working on all mksh binaries. So perhaps we just need a new static mksh binary installed?
Tab expansion is pretty broken on BSD with xterm and GNU screen, but the same seems to work better on ssh’ing out to Linux, I wonder why, since all software involved is the same… except tput though. But it works like that and is usable. With post-R40 mksh, you can get about with even less hacks (more similarity to AT&T ksh).
Click to expand...
Click to collapse
However, this still doesn't explain why I have no controlling tty for ssh sessions.
Also I tested a new and different SSH server called SSHelper, which has more features and is better maintained, without ads, but is also 6 times larger at ~ 6MB, because of included OpenSSH, FTP and webserver log functionality. When logging in via ssh I get:
Code:
...
Server refused to allocate pty
Followed by an empty non-responsive connection.
Is this the same as […]this problem elsewhere? Man, I'm searching for ideas and keep coming back to your questions all over the 'net
To clarify, I talked to someone at Google; they renamed mksh into just sh lately, but this should have no adverse effect. They currently ship R48 and “would have updated it if I knew there was a new version”. That being said, the code of the shell itself is not at fault here.
The “no controlling tty” message here is a red herring: you do not have access to a tty at all, let alone a ctty
As I said elsewhere, use “ssh -t” and either change the SELinux policies to allow pty/tty pair allocation, or disable it (possibly set it into permissive mode).
@mirabilos: Yes, thanks for that info. I haven't updated this thread since I started it, in anticipation of a writeup about SELinux. However, that proves to be a little over my head, so it will take some time. What is clear though, is that the above problem is connected with the SEAndroid protection mechanisms, which in turn have been mangled and incorporated into Samsungs KNOX.
Also I have been busy making the SSHelper support thread:
[APP][INFO|SUPPORT] SSHelper (The free Android SSH Server Application)
There I have also added a small section about mksh.
@ E:V:A - I recently put together a little package containing all necessary bins/scripts to create a SSH server (via dropbear and dropbearkey) (properly secured, not public) and connect with a SSH client (ssh). The package also contains bins/scripts to create a Telnet server (via utelnetd) and connect with Telnet client (via "static busybox" telnet). Everything works with superuser that I've tested. Linked in my signature and attached to post as well.
Instructions (for anyone who sees this and would like a guide)::
Basically just extract it anywhere with:
Code:
tar -xf easy.ssh.and.telnetz.clients+servers.tar.gz
(if it's in /sdcard/Download which is probable, do "cd /sdcard/Download" then run the above)
Change directory inside the folder:
Code:
cd ./ssh.telnetz
There are 6 scripts: ssh.start(connect to ssh server via ssh), sshd.start(create ssh server), ssh.kill(kill ssh processes and remove ssh server keys), and... 3x telnet scripts for the telnet equivalents.
Running scripts and optional parameters:
Code:
./telnetd.start [ shell ]
e.g. TELNET_PORT=8080 ./telnetd.start /system/bin/mksh
./telnet.start [ ip port ]
e.g. ./telnet.start 192.168.0.3 8080
./sshd.start [ <dropbear_flags_and_options ]
e.g. ./sshd.start (default port is 8090)
./ssh.start [ ip port shell ]
e.g. ./ssh.start 192.168.0.3 8090 /system/bin/mksh
Default ip is the loopback 127.0.0.1 so you can test running a server and connecting to it on your phone at the same time. Just change params as described above to connect from/to your phone (phone is client/server).
***As far as I have tested on Android 4.4.4, this works perfectly as root or restricted user. You can get a su'd ssh shell by starting the sshd.start with /system/xbin/su or just entering su after you've connected as a restricted user.***
I've finally found a work-around for the crippled /dev/pts job-control and su combination. There are two small problems that combines to this issue.
1. The SELinux policy is screwed up by Samsung. And others?
2. The /dev/pts is mounted wrong by default.
The work-around:
Make sure you're device is already in Enforcing mode, so that you get the proper su prompt (#).
1. Open terminal session 1.
Code:
[SIZE=2]
## On Terminal 1
ssh -2 [email protected] -p 2222
$ su -c /system/bin/sh -i
# su 0 setenforce 0
# umount /dev/pts
# su -cn u:r:init:s0 -c "busybox mount -t devpts -o rw,seclabel,relatime,mode=620,gid=5 devpts /dev/pts"[/SIZE]
2. Now go to Terminal 2 and login:
Code:
[SIZE=2]## On terminal 2
ssh -2 [email protected] -p 2222
$
[/SIZE]
(You now have job-control but no su possibility.)
3. Now go back to Terminal 1 and enable Enforcing mode:
Code:
[SIZE=2]## On Terminal 1
# su 0 setenforce 1
[/SIZE]
4. Now go back to Terminal 2 and escalate to su:
Code:
[SIZE=2]## On terminal 2
$ su -c /system/bin/sh -i
# [/SIZE]
Unfortunately if you exit the su (#) shell, you'll have to repeat steps 2-4 of the procedure.
So I'm currently building an AOSP Marshmallow based ROM (Chroma) to my Android One device (sprout).
I've modified the sepolicy to make RIL works, etc.
But I have one thing, adb doesn't seem to work properly. I have to sudo adb shell to get to adb. And if I do it on Windows, I will get straight to root user in phone's shell (# instead of $).
Here is my device tree:
https://github.com/kclkcl/android_device_google_sprout-common
As you can see there is an adbd.te file in sepolicy folder. I could not successfully build the ROM with this file, if I delete this, the build will go fine and complete.
Here is the error:
Code:
evice/google/sprout-common/sepolicy/adbd.te:2:ERROR 'unknown type auditd_log' at token ';' on line 14045:
#line 1 "device/google/sprout-common/sepolicy/adbd.te"
allow adbd auditd_log:dir getattr;
checkpolicy: error(s) encountered while parsing configuration
make: *** [out/target/product/sprout8/obj/ETC/sepolicy.recovery_intermediates/sepolicy.recovery] Error 1
I wonder what's wrong with my sepolicy, and why I couldn't build with that adbd.te file there. Do I need that policy to be able to use adb normally?
As you can see in the picture, when I type adb devices, it list my device, but it says no permission
http://imgur.com/LMqwldc