:::BRIEF DESCRIPTION:::
mksh is the official, currently-developed shell used for Android. It is not an app nor a virus (lol) like some people seem to think, looking at a quick xda search. And as the core shell for android, it is used to shell superuser, so if you're rooted and get a message saying "mksh requests root", that basically just means that superuser is being run correctly and is using the default Android shell that is in every Android device. (GOOD)
If you get a message saying bash(or any other shell) requested root, and you're NOT in the terminal interactively. That most likely is NOT GOOD! Almost all bash scripts I've seen will run shelled with mksh, so be safe and shebang with mksh. You'll have better performance and features, and when you see bash requesting root, you'll know when your security is likely compromised.
::: mksh Resources/links/info :::
mksh author: mirabilos (on xda forums)
mirbsd mksh main page: https://www.mirbsd.org/mksh.htm
mksh man page: https://www.mirbsd.org/htman/i386/man1/mksh.htm
edited 15Aug2014
Now that that's out of the way, I've attached a few zips in the 2nd post. The first contains my personalized mkshrc (startup mksh script), the full original mkshrc it's based on, and a diff for anyone who's interested. **This file belongs at /system/etc/mkshrc.** The rest of this first post details what I've cooked up in my mkshrc (and fpath functions). The other zips' contents are described in the 2nd post.
Features scripted into mkshrc:
--sudo: basic su executor
e.g.:
Code:
sudo mount -o rw,remount -t f2fs /system /system
sudo cat <<< $'\n' >> /system/build.prop
sudo 'sysrw; for i in /system/*; do chown 0 "$i" ; done; sysro'
--suid: (set user id) Uses chpst to run a prog setsuid, this is broken in most busyboxes so I included one with a working chpst. Usage:::
e.g.:
Code:
suid 1000 sh
--Rebind tab completion: unjams clustered words:
e.g.: <[cursor]> is cursor position
Code:
bind -m -- '^I= ^B^[=^D'
<<EXAMPLE USAGE>>
ec<[cursor]>12345 + tab ---> echo 12345
--Rebinded "control + u" to "cut-to-beginning of line" like bash. (As mirabilos points out, this is ksh incompatible behaviour since "control + u" is "kill-line" in *ksh shells. This can be removed from the (/system)/etc/mkshrc shell startup file if it presents any problems in editing.) The exact binds are:
Code:
bind -- '^[W=kill-region'
bind -m -- '^U=^[ ^A^[W'
<<EXAMPLE USAGE>>
ec<[cursor]>12345 + ctrl + u ---> <[cursor]>12345
--TMPDIR: mounts a tmpdir at /tmp for all users and random generates subdirs for individual secured tmpdirs. This fixes here-docs, here-strings, and here-executions.
e.g.:
Code:
su << 'eof'
sysrw; chgrp 2000 /system/bin; sysro
! (( $? )) && print -- -changed them bin group-
eof
--Basic "help" command: Android lacks this and the doc is still under development I believe. I added all the basic info/command-forms for mksh bultins to a command help(aliased to h):
e.g.:
Code:
help mkn
> mknod [-m mode] name b|c major minor
> mknod [-m mode] name p
or
Code:
help
(all help is printed, grep from here if you want)
--Complicated-programmed and colorful PS1 prompt, it looks good and I thought it through. Programming shows mksh potential for rich shell programming. It auto-turns off xtrace within itself (to 3 lines) so that 50 lines don't get printed each return with set -x. mksh small (R43 mksh) will be autodetected and give a different white and black classic ksh prompt.
--ton of ultra lazy aliases, got my android scripting speed up to ~70% my normal pc speed.
--dot.mkshrc functions from official mkshrc like pushd, popd, dirs, more, hd, Lb64encode, Lb64decode, hash optimizations
The scripting in this gets pretty complex, especially the inherent mkshrc functions. It would make a good scripting learning tool to say the least. I know I've learned twice what I knew from bash scripting back 3 months ago.
I've been working on modding the mkshrc a while, so I appreciate any error reports if you give mine a try. Shouldn't be any problems though.
Modifying the mkshrc file / mksh shell has system-wide effects, so PLEASE nandroid backup as usual!!! This should be COMPATIBLE with all androids, but has only been tested on my Galaxy Nexus thus far. **The binary is compatible with androids using an ARM cpu, but the steps in the 3rd post will generate a binary for whatever ARCH you're running.**
EDIT: reprogrammed sudo with pexec, so it can do parallel executions. pexec, grep, and a full busybox are included in a zip with some other bins.
For Jack Palevich's terminal emulator or connectbot, telnet, etc, I use this as my su'd "shell" command under >>Options>>Shell:
Code:
/system/xbin/su --shell /system/bin/mksh --command exec /system/bin/pexec -z -15 --shell /system/bin/mksh -m '/system/bin/mksh'
What's safer though is to just use a non-su shell command:
Code:
/system/bin/mksh -
...and then use sudo for your su commands. This is more linux'y.
EDIT2 (big update): Got static mksh R50 compiled. Ended up booting ubuntu in Android to compile instead of cross-compiling. mksh's Build.sh compiler script works great. I just had to "sudo apt-get install gcc" and bam it built with "LDSTATIC=-static ./Build.sh".
EDIT3 - Changed main.c source mkshrc file to /system/etc/mkshrc, perfect static mksh R50 now.
EDIT4 - Changed compiler to klcc to get size way down, now at 196KB with -O2 LTO speed optimizations.
EDIT5 - Binary is updated to R50d, compiled with CFLAGS=-Os, and stripped to get size down to ~140KB. (This is even smaller than the R43 dynamic mksh binary that is currently used in roms.)
EDIT6 - Added a mksh trunk (latest and greatest) binary with the printf builtin compiled in. Use with caution. Btw, if you read all the way down here, then yes, these binaries work in lollipop since they're statically compiled.
:ownloads:: (#7 or #8 is the static binary by itself)
(1) mksh R50 source, binary, manual
(2) Highly compressed pack of extra bins/libs that are mentioned in my mkshrc (zsh, lz4c, grep, busybox, bash, nano, vim, curl, etc) and some other cool ones like macchanger and ed. Download #3 to extract on Android.
(3) 7za in case you need it to extract (2) on Android.
Code:
7za x name_of_archive.7z
(4) Classic unix text editor "ed" which mksh uses for edit functionality. (Copy to /system/bin along with mksh.)
(5) Official mkshrc (unzip and copy to /system/etc, set permissions to 0444)
(6)
My personalized mkshrc startup mksh shell script based on the official full mkshrc 2014/01/11 release. Described in first post. If you try this, make sure to symlink /system/xbin/busybox to /system/bin/busybox.ndk.
Official mkshrc 2014/01/11 release
"diff -ur /system/etc/dot.mkshrc--official.mkshrc mkshrc" (diff patch set from official mkshrc to my personalized mkshrc)
(7) mksh static binary! (Just unzip, "chmod +rx" it, and copy to /system/bin or run from anywhere, no libs required )
(8) mksh R50e with printf builtin (I know some people were looking for this)
::: Building mksh Static On Android (really Ubuntu though..):::
This is just for anyone who wants to try, and especially those without access to a PC.
Things we'll need besides your phone:
-"Android Terminal Emulator" app {get it from (http://jackpal.github.com/Android-Terminal-Emulator/downloads/Term.apk) or fdroid or gplay}
-"Complete Linux Installer" app {get it from (http://sourceforge.net/projects/linuxonandroid/?source=typ_redirect) or gplay or maybe fdroid}
-internet/wifi
-mksh source {download from (https://www.mirbsd.org/MirOS/dist/mir/mksh/mksh-R50.tgz) or link in first post or DL in second post}
1) We need to get Ubuntu or Debian booted for a sufficient build environment. I've used both on Android but I like the better stocked terminal in the Ubuntu images. I used the app Complete Linux Installer which is free and works beautifully, very simple and easy too. In the app you want to follow the short instructions to download an Ubuntu image, rename it to ubuntu.img, and place it in a folder named ubuntu in /sdcard. Then hit menu in the app and click the terminal screen icon that says "Launch". An Ubuntu terminal will now open in Android Terminal Emulator. Super quick and easy.
2) Let's download GCC and ed so we can build and test with zero errors.
Code:
apt-get install -y gcc ed
3) Now the cool thing about this chroot Ubuntu environment is that we still have access to the sdcard to transfer files between Android environment and the chroot jail. Extract your downloaded mksh source to your Ubuntu home with something like:
Code:
cd
tar -xf /sdcard/Download/mksh*.tgz
cd mksh
4) Since we're building this for Android, the mkshrc file is at /system/etc/mkshrc instead of ~/.mkshrc, so we can change this with:
Code:
sed -i 's|~/.mkshrc|/system/etc/mkshrc|' ./main.c
Now we can build mksh statically:
Code:
chmod +x Build.sh
MKSHRC_PATH=/system/etc/mkshrc LDSTATIC=-static ./Build.sh -r -c lto && ./test.sh
Let the build script crank out the binary for a couple minutes and run the test suite. There should only be an error on a "mkshrc" test since we changed it for android. The "-r -c lto" flags/opt aren't needed but recommended.
Edit: (size optimization): Strip the compiled mksh binary to make it super small (~150KB with a CC="klcc" or CC="diet gcc" compile).
Code:
strip --strip-unneeded ./mksh
5) Now let's copy it to /system/bin to replace your old one.
Code:
cp ./mksh /sdcard
(Open a new terminal tab to get into Android Environment)
sysrw
cp -f /sdcard/mksh /system/bin
chmod 0555 /system/bin/mksh
sysro
.. and done. Run some scripts and enjoy your static mksh!
*** OPTIONAL EXTRA STEPS TO USE klcc or other compiler ***
In step (1), also do
Code:
apt-get install -y libklibc-dev
to get the klibc development tools, and then...
In step (4), this is how you specify to use klcc (aka build against klibc using the klcc wrapper):
Code:
CC="$(which klcc)" MKSHRC_PATH=/system/etc/mkshrc LDSTATIC=-static ./Build.sh -r -c lto && ./test.sh
:::Compile mksh in Android (for ARM):::
1) Download the attached cross-compiler and mksh source (https://www.mirbsd.org/MirOS/dist/mir/mksh/mksh-R50.tgz). Copy them to /data/media. If you don't have 7za, download that as well from the previous post but place it in /system/bin and "chmod +x" it
2) Extract contents:
Code:
cd /data/media
7za x -so 2014-10-01__simple-cross-compiler-armv4tl.stripped.tar.7z | tar -xf -
tar -xf mksh*.tgz
3) Compile the source with:
Code:
cd mksh
chmod +x Build.sh
LDFLAGS=-static CC=../simple-cross-compiler-armv4tl.stripped/bin/*gcc ./Build.sh -r -c lto
../simple-cross-compiler-armv4tl.stripped/bin/*strip -s mksh
4) Replace old mksh and mkshrc
Code:
mount -o rw,remount /system
cp mksh /system/bin
cp dot.mkshrc /system/etc/mkshrc
chmod 0555 /system/bin/mksh
chmod 0444 /system/etc/mkshrc
mount -o ro,remount /system
@7175 : Hello! Look like a bunch of hard work there. Very nice.
1. Would you have any clue to what's going on HERE?
2. Would you know if I can just install over my old mksh binary to get this working, or do I need "everything"?
3. And since I've heard that /system/bin/mksh will soon be permanently only /system/bin/sh perhaps this need to be changed?
Hey E.VA. thanks for checking out the thread. If you want to just test out R48 mksh, just copy(from zip root directory) the lib*.so from /data/media/shell to /system/lib and then copy /data/media/shell/mksh to /system/bin (and chmod 0555 /system/bin/mksh; chmod 0444 /system/lib/*.so). Then you'll have your whole system running full mksh R48.
As far as the ssh problem with android, this definitely becomes grey-zone material to my knowledge, which is limited in this area. I'm pretty sure android has udev amputated so it lacks a fully working /dev/tty. This could probably be patched over though with some terminal work, mknod action. I've gotten ssh working under "terminal ide", but haven't used the stock ssh stuff in /system/bin. Now that you mention this though, I will try and get stock ssh going as well as openssh which had a similar problem last time I tried (thx for mentioning your support thread, I'll be checking that out).
Here's what I searched to shed a little light on that ssh /dev/tty issue: duckduckgo.com/html5/?q=ssh+%27dev%2Ftty%27+error.
It looks like you've done a ton of searching though.
For su commands, I would try using, e.g.,
Code:
su exec [i]command[/i]
...opposed to "su -c", or better e.g.,
Code:
su -c exec /system/bin/sh -c '[i]command[/i]'
...and see if that gives any different results.
I just know from experience "su -c" hasn't always cut it.
*edit: Couple other things worth trying:
1) preappend command with environment variable: global TTY=/dev/pts/0 ...
2) use the -T option when calling mksh, i,e. ssh ... -e mksh -T /dev/pts/0 ...
@7175 : Hey thanks for looking into this. I will definitely try your suggestions.
However, I've already tried the -T flag to ssh, but never by specifying the pts to use, as it should be dynamically allocated by the ptmx. (As it could be already in use, by something else, like ATE.) Also, what does "global" do?
You also mentioned "stock ssh" in /system/bin. I've never seen that. Perhaps that could be a better solution, unless its' even more crippled. Does it also support sshd (i.e. ssh -D)?
In the mean time, is there any particular reason why you decided to dynamically link mksh? (I assumed it would have been more portable with static linking?)
I see that you did a huge amount of work on that mkshrc script. Looks crazy (in a good way)!
Finally, and aside, I also noticed that when I start mksh from ssh session, there are some aliases in there, that is not specified in the mkshrc, nor the .profile of my SSH server, so where the heck do they come from?
Code:
[SIZE=2][email protected]:home # alias
autoload='typeset -fu'
functions='typeset -f'
hash='alias -t'
history='fc -l'
integer='typeset -i'
local=typeset
login='exec login'
nameref='typeset -n'
nohup='nohup '
r='fc -e -'
source='PATH=$PATH:. command .'
type='whence -v'[/SIZE]
Perhaps they're hardcoded or sourced from somewhere? Have you seen this?
E:V:A said:
@7175 : Hey thanks for looking into this. I will definitely try your suggestions.
However, I've already tried the -T flag to ssh, but never by specifying the pts to use, as it should be dynamically allocated by the ptmx. (As it could be already in use, by something else, like ATE.) Also, what does "global" do?
You also mentioned "stock ssh" in /system/bin. I've never seen that. Perhaps that could be a better solution, unless its' even more crippled. Does it also support sshd (i.e. ssh -D)?
In the mean time, is there any particular reason why you decided to dynamically link mksh? (I assumed it would have been more portable with static linking?)
I see that you did a huge amount of work on that mkshrc script. Looks crazy (in a good way)!
Finally, and aside, I also noticed that when I start mksh from ssh session, there are some aliases in there, that is not specified in the mkshrc, nor the .profile of my SSH server, so where the heck do they come from?
Code:
[SIZE=2][email protected]:home # alias
autoload='typeset -fu'
functions='typeset -f'
hash='alias -t'
history='fc -l'
integer='typeset -i'
local=typeset
login='exec login'
nameref='typeset -n'
nohup='nohup '
r='fc -e -'
source='PATH=$PATH:. command .'
type='whence -v'[/SIZE]
Perhaps they're hardcoded or sourced from somewhere? Have you seen this?
Click to expand...
Click to collapse
Thanks man lol it's a big rc. It was 50KB before I converted a bunch of the functions to fpath functions in /etc/fpath and stripped most of the comments. It should give a pretty quick shell in terminal though with the ulimit and renicing tweaks. The PS1 prompt is pretty awesome, probably the best thing in the mkshrc I included.
"global" is a function just like "typeset" or "declare" in bash. The difference is that global prevents an accessed variable from being localized/ different than the global value in a function. This is a mksh function, bash will use "declare -g". There are a couple of example usage in the mkshrc, like with the set -x spam fix for the command prompt.
I checked and stock ssh in /system/bin has the "-D" flag. I would also check rolo's zshaolin zsh project which comes with some afterstock ssh stuff, ssh keygen, ssh keysearch, different ssh etc.
Yeah I just symlinked sh to save space really and for portability to try out other shells like bash and zsh(this works!) to run the system. Recently I switched to using a copy of mksh as sh since "chattr +i" wasn't protecting the symlink from being over-linked.
The aliases you posted are in fact hard-coded. If you do "strings /system/bin/mksh | grep -C7 autoload" or something similar, you'll see them in the binary. I always wondered where those came from too until I read through the mksh manual over a couple months, that's some pretty dense reading lol. mksh is a superb shell though, so it's definitely well worth it.
Sorry I can't be of more help with the ssh /dev/tty problem. I will keep my eyes open though, and try not to be so lazy using telnet for all my remote connections. I mean that's basically using the internet without a condom lol.
(*Also, just something I should mention about the install zip contents: not all the /etc/fpath functions are finished yet. I still gotta tweak the ssh ports from /etc/ssh and finish my xargs. Most should work though and are safe and won't interfer with shell usage, even if autoloaded.)
@mirabilos :
Hi, why did you choose to hardcode the aliases (shown in post#6) into the mksh binary?
Also, do you have a later version than the R48 Android binary above?
The "r" alias is particularly disturbing as it is masking the native toolbox use of "r" to read a memory location.
7175 said:
with the ulimit and renicing tweaks.
Click to expand...
Click to collapse
Why do they need to be tweaked?
I checked and stock ssh in /system/bin has the "-D" flag. I would also check rolo's zshaolin zsh project which comes with some afterstock ssh stuff, ssh keygen, ssh keysearch, different ssh etc.
Click to expand...
Click to collapse
Sorry my bad, I was sleepy and mistakenly understood "-D" as running SSH in daemon mode, when in fact it does the opposite and prevents it. Seem like his links are dead or I'm just looking in the wrong place.
Recently I switched to using a copy of mksh as sh since "chattr +i" wasn't protecting the symlink from being over-linked.
Click to expand...
Click to collapse
Not sure what you're saying here...
Sorry I can't be of more help with the ssh /dev/tty problem. I will keep my eyes open though, and try not to be so lazy using telnet for all my remote connections. .
Click to expand...
Click to collapse
Thanks, but if telnet works with tty/pts jobcontrol and vi etc, then I'm fine with that for now. I tried your command variations above and got this:
Code:
[SIZE=2]#ssh -2 [email protected] -p 2222 -T su -c exec /system/bin/sh -i # This worked!
#ssh -2 [email protected] -p 2222 -T su -c exec /tmp-mksh/tmp-mksh -T /dev/pts/0
/tmp-mksh/tmp-mksh: chvt: can't find tty /dev/pts/0
#ssh -2 [email protected] -p 2222 -T su -c exec /tmp-mksh/tmp-mksh -T /dev/ptmx
/tmp-mksh/tmp-mksh: chvt: new shell is potentially insecure, can't revoke /dev/ptmx
[/SIZE]
The fist one is good to get direct root prompt, the second fails, since pts/0 has not been created yet, and if it has, it fails with permission issue, since another process is trying to steal the pts. The reason why the third one fails, is very cryptic and I don't understand the error message and neither the code generating it.
Do you think one could use the ATE app to get a working root shell by the use of a more complex ssh command? Any suggestions how that would look?
Finally, I'm a bit worried about replacing the libc.so dependency, since the whole system depend upon it, and would probably not boot if an incompatible libc.so is used. This is why I asked about a static binary. I'd much rather have a bloated mksh than having to add library files. (We have plenty of memory and space these days.)
Regarding compiling, I would recommend using Linaro a build, rather than the crappy and often broken/outdated Code Sourcery junk.
Check this thread:
[LINARO GCC] Cross Compiler Toolchains [Linaro GCC 4.9 2014.07, 4.8 and 4.7 2014.04][19/07/2014]
Cheers!
7175 said:
--Better tab completion: unjams clustered words:
--Added "control + u" to "cut-to-beginning of line" like bash.
Click to expand...
Click to collapse
Hi! As the author of mksh, I am hereby explicitly requesting you to add a suffix to the shell version, similar to what the PLD Linux guys do here, because this changes the behaviour of the shell in an incompatible way. (Just add your own string there after a space, the @distro@ is just a placeholder that gets replaced with the PLD Linux package version.)
Do note that ^U in Korn Shell (and others) is “delete entire line”.
7175 said:
--Very complicated-programmed and colorful PS1 prompt, it looks good and I thought it through. Programming shows mksh potential for rich shell programming. It auto-turns off xtrace within itself so that 50 lines don't get printed each return with set -x. mksh small will be autodetected and give a different white and black classic ksh prompt.
Click to expand...
Click to collapse
Interesting idea, I think I will pick up the “set +x” thing.
Do you mind sharing a patchset of all your changes, so I can incorporate those I feel would be good to have in general?
7175 said:
EDIT: It appears the libc required for full mksh isnt always friendly
Click to expand...
Click to collapse
Just link the shell statically, then.
E:V:A said:
1. Would you have any clue to what's going on HERE?
Click to expand...
Click to collapse
You are annoying me. I've told you times and times again to disable SEAndroid, or to fix its SELinux policies.
E:V:A said:
2. Would you know if I can just install over my old mksh binary to get this working, or do I need "everything"?
Click to expand...
Click to collapse
Define “everything”. mksh in AOSP is /system/bin/mksh plus mkshrc.
E:V:A said:
3. And since I've heard that /system/bin/mksh will soon be permanently only /system/bin/sh perhaps this need to be changed?
Click to expand...
Click to collapse
I'm working with enh of Google on that. I would like for mksh to be installed as /system/bin/mksh and /system/bin/sh to be a link/copy of it, always. He said he'd agree I could change that back.
E:V:A said:
Hi, why did you choose to hardcode the aliases (shown in post#6) into the mksh binary?
Click to expand...
Click to collapse
These are part of the shell, and have always been, even in pdksh times.
E:V:A said:
Also, do you have a later version than the R48 Android binary above?
Click to expand...
Click to collapse
I do not deal in binaries normally. I'm somewhat working on updating AOSP to mksh CVS HEAD, in tandem with enh from Google, but when I had the time for that, it appears they changed the build system requirements. But it will be there.
It's not as if a newer mksh version would fix your SELinux problem, though…
E:V:A said:
The "r" alias is particularly disturbing as it is masking the native toolbox use of "r" to read a memory location.
Click to expand...
Click to collapse
The “r” alias is especially required for the Emacs command line editing mode. Interesting that toolbox uses it too. Thanks for bringing this to my attention, I will ask enh to change “r” in toolbox.
@E:V:A : Glad the first execution you mentioned worked. I would try messing with quotes/double quotes around the shell command, i.e. ssh ... -T su -c 'exec ...' or try ssh ... -T su -c exec "...", as something to test out further. This can make a lot of difference.
The ulimit shell function can control all sorts of performance related stuff, priority, max niceness, etc. You can see all values with "ulimit -a".
I understand your hesitance about the libc.so replacement. I would keep a copy of the old one and twrp backup before trying out a new one. I get what you're saying about statically linked binaries. I just fixed my i7 desktop that had a blown power supply, so I'll be looking into this. Thanks for the linaro link!
@mirabilos : Thanks for taking a look at this and providing us with mksh! I updated my OP with the specifics about the rebinds for "control I" and "control U" that you mentioned, and I added a suffix to the beginning comments of the file. Something like:
Code:
# $MirOS: src/bin/mksh/dot.mkshrc,v 1.88 2014/01/11 18:09:39 tg Exp $Android_mod by [email protected] 2014/08/04$
Not sure if that's what you wanted me to add in. I included an extra zip to download in the 2nd post that contains the official mkshrc 2014/01/11, my personal mkshrc, and a "diff -ur" patch (also attached to this post).
I will look into getting a statically linked mksh compiled, that sounds like something really handy to keep around.
edit: Here's basically what I added to the beginning and end of PS1 to trim down its "set -x" verbosity to 3 lines. I'd like to get it down more but haven't figured it out.
Code:
PS1=$'\001\r'; PS1+='${|
local e=$?
[[ -o -x ]] && set +x && global -x XTR_DBG=1 || global -x XTR_DBG=0
...
...
...
(( XTR_DBG )) && set -x
return ${e}
} '
7175 said:
@mirabilos : Thanks for taking a look at this and providing us with mksh!
Click to expand...
Click to collapse
You’re welcome!
7175 said:
Not sure if that's what you wanted me to add in.
Click to expand...
Click to collapse
Ah, so you did not patch the mksh binary, only the mkshrc file?
But then, that’s okay as you wrote, sure.
7175 said:
I included an extra zip to download in the 2nd post that contains the official mkshrc 2014/01/11, my personal mkshrc, and a "diff -ur" patch (also attached to this post).
Click to expand...
Click to collapse
OK, thanks. Will have a look at it within the next weeks (August is going to be a busy month for me).
I’m assuming you are okay with me adding some of your changes back to main mksh?
7175 said:
I will look into getting a statically linked mksh compiled, that sounds like something really handy to keep around.
Click to expand...
Click to collapse
Indeed, it is.
The first mksh run on Android actually was statically compiled against µClibc, though that’s cheating. (Also, dietlibc and klibc are better than µClibc). I think it should work against Bionic, too.
7175 said:
edit: Here's basically what I added to the beginning and end of PS1 to trim down its "set -x" verbosity to 3 lines. I'd like to get it down more but haven't figured it out.
Click to expand...
Click to collapse
I don’t think it works in less, considering you have to save the previous $?. There are a few handy tricks around. I tried these four:
#1 is:
Code:
local e=$?
[[ -o -x ]]; local x=$?; set +x
(( e )) && REPLY+="$e|"
[…]
(( x )) || set -x
return $e
This is about what you did. #2 is:
Code:
local e=$? x=$([[ -o -x ]]; echo $?); set +x
(( e )) && REPLY+="$e|"
[…]
(( x )) || set -x
return $e
This only looks different (I’d prefer #1 over this.) #3 is:
Code:
set +x $? $([[ -o -x ]]; echo $?)
(( $1 )) && REPLY+="$1|"
[…]
(( $2 )) || set -x
return $1
This reduces visual clutter. #4 is:
Code:
set +x $? $([[ -o -x ]]; echo $?)
(( $1 )) && REPLY+="$1|"
[…]
(( $2 )) && return $1
(( $1 )) && set -x && return $1
set -x
This reduces visual clutter even more, in that, when $? is 0, one line less is shown. But it makes the number of lines shown be not always the same. YMMV on whether to use this, #3 or #1.
This could be made even nicer *iff* mksh had the EXIT trap when leaving a function. The manpage says it’s TODO. This part of the manpage is from 1999 or older. (I started mksh in late 2002, early 2003.) Go figure… But now I have a reason to add it ☺
Another thing you could do is “set +o inherit-xtrace”, which makes functions not run with “set -x” when the main body runs with it. But wait, I see now that it does not affect ${|…;} blocks. This is a bug, which I’ll fix ☻
@mirabilos:
You Wrote:
1. Would you have any clue to what's going on HERE?
Click to expand...
Click to collapse
You are annoying me. I've told you times and times again to disable SEAndroid, or to fix its SELinux policies.
Click to expand...
Click to collapse
Well, you can be as annoyed as you like. First of all, that question was not aimed at you, and second, as I have also said repeatedly, I have already tried using SELinux in Permissive mode and it doesn't work either. In addition, your suggestion to "fix its SELinux policies" is rather ridiculous as there are no tools available to do so. At least nothing out of the box and no available binaries anywhere, and surely no instructions how to do so. So if you know how to do it, why don't you just explain for us how to do so. (My policies are updated to latest according Androids policy update tools.)
In addition there is no such thing as "disable SEAndroid". It's either in Permissive or Enforced mode. That is, unless you flash a new custom FW, which is out of the question. In addition, ATE works just fine, in Enforcing mode.
So believe me, I am far more annoyed by Googles lack of SELinux/SEAndroid developer support, than you will ever be from me asking these questions.
Thanks for explaining and helping with everything else above.
@7175:
The ulimit shell function can control all sorts of performance related stuff, priority, max niceness, etc. You can see all values with "ulimit -a".
Click to expand...
Click to collapse
Yes, I know about all those things, but I was asking why you think they need to be tweaked? The defaults, seem to work just fine.
@mirabilos : Thank you for your detailed replies, and I would be more than happy to contribute if you see anything from the content I posted.
It is interesting to see the other possibilities for turning off xtrace within the PS1. I didn't even realize you could set positional parameters after the set -x... I think I like that one the most. It just seems more array-like and streamlined, although I guess the same number of variables is still used. I look forward to seeing what updates you'll have on the exit trap and localization. This is something I'd like to toy around with.
I took your advice and set out to get a mksh static built. I ended up compiling with GCC, running "LDSTATIC=-static ./Build.sh" in the mksh source directory. I'm pretty new to cross compiling, so I didn't really get that far or try that hard before chrooting to a fresh Ubuntu terminal on my Nexus, installing GCC, and compiling there. The only thing I changed in the source code was ${ENV:-~/.mkshrc} to ${ENV:-/system/etc/mkshrc} in the "main.c" source file. I can include this in the OP though as you mentioned before. (edit: just saw this as a compiler option with Build.sh)
Edit: I see the option now in the Build.sh for changing the mkshrc path. Also, got R50 rebuilt static with klibc. Damn that got the size way down from using glibc, 684K to 204K.
R50e is released
R50e is released -- see https://www.mirbsd.org/mksh.htm#clog
Hi @7175, good stuffs here man :good:
I've been using your modded mkshrc, and I can see a hell of a lot of work you put into it. Looks really cool. Plus it's really a good place to learn for someone like me, I definitely had learnt a lot for the past few days. Tons of aliases too, and I'm getting used to using it now. I really appreciate your stuffs here, hope to see more of it
alanthehat said:
R50e is released -- see https://www.mirbsd.org/mksh.htm#clog
Click to expand...
Click to collapse
Thanks for the heads up. Updated the binaries posted in the 2nd OP to mksh R50e.
Reinkaos said:
Hi @7175, good stuffs here man :good:
I've been using your modded mkshrc, and I can see a hell of a lot of work you put into it. Looks really cool. Plus it's really a good place to learn for someone like me, I definitely had learnt a lot for the past few days. Tons of aliases too, and I'm getting used to using it now. I really appreciate your stuffs here, hope to see more of it
Click to expand...
Click to collapse
Thanks for the feedback man! Glad it's been a good learning experience like it has been for me.
7175 said:
Thanks for the feedback man! Glad it's been a good learning experience like it has been for me.
Click to expand...
Click to collapse
Well, thanks for the updated binary! Anyway, anything you can recommend me to read other than the man page in OP? And I have one more question, what's the difference between the busybox (I got one from your other thread) and yours busybox.ndk?
While I’m the upstream developer of mksh, hacking it has also been a good learning experience for me.
So it is for a friend of mine, who has taken some fundamental script frameworks I wrote, and extended it to an impressive management system, learning to code good shell while doing so.
I’m always happy when my stuff helps other people, and they share their joy! ☺
By the way: new mksh release announcements are sent over the miros-mksh mailing list (send an eMail to postmaster at mirbsd dot either org or de to subscribe).
---------- Post added at 08:40 PM ---------- Previous post was at 08:34 PM ----------
Well, we have https://www.mirbsd.org/ksh-chan.htm which collects lots of Korn Shell-related resources, although most of it is for AT&T ksh93 (the “original” Korn Shell), much also applies to mksh, though the Android OS has some special handling (especially caused by the different user-space tooling) obviously.
The shell itself behaves exactly the same across *all* supported platforms though, so (once you have set $TMPDIR to something writable for your current user) you can write Pure mksh code exactly like on Unix or Cygwin or the Macintosh or even Haiku.
mirabilos said:
While I’m the upstream developer of mksh, hacking it has also been a good learning experience for me.
So it is for a friend of mine, who has taken some fundamental script frameworks I wrote, and extended it to an impressive management system, learning to code good shell while doing so.
I’m always happy when my stuff helps other people, and they share their joy!
By the way: new mksh release announcements are sent over the miros-mksh mailing list (send an eMail to postmaster at mirbsd dot either org or de to subscribe).
---------- Post added at 08:40 PM ---------- Previous post was at 08:34 PM ----------
Well, we have https://www.mirbsd.org/ksh-chan.htm which collects lots of Korn Shell-related resources, although most of it is for AT&T ksh93 (the “original” Korn Shell), much also applies to mksh, though the Android OS has some special handling (especially caused by the different user-space tooling) obviously.
The shell itself behaves exactly the same across *all* supported platforms though, so (once you have set $TMPDIR to something writable for your current user) you can write Pure mksh code exactly like on Unix or Cygwin or the Macintosh or even Haiku.
Click to expand...
Click to collapse
Thanks for the link, and for your works on mksh too! I'm really new to shell, I'm not even that familiar with unix/linux either. But I always have been interested in shell scripting, so I'm glad that I stumbled upon this thread
Whew, that's a lot of stuff in that link you gave, definitely gonna make use of it, thanks again!
Hi,
IT MIGHT BRICK YOUR DEVICE.
Always ensure you have a way back.
Here is a thread about my fork of Koush's Superuser, to handle SELinux: https://github.com/seSuperuser/Superuser
So I would like your help to make this SuperUser a proud opensource SU app!
If you have an application that requires root, and which needs specific SELinux configuration please ask!
Build bot: https://superuser.phh.me/
Currently, four flavors of su are available on the build-bot:
- "eng" which puts "su" in permissive mode. This is the most compatible mode, but you should trust the apps you give root to. This does NOT put SELinux in permissive mode.
- "noverity" is eng and dm-verity disabled
- "nocrypt" is eng, dm-verity and dm-crypt disabled
- "user" is meant to give a safe su. su-apps won't be able to access to your Android Pay (for instance) informations, or keep persistent su access without your consent
Please note that user is in heavy development and isn't up to its promises at the moment.
I setup a build bot, which generates boot.img based on my solution, and pushes them to https://superuser.phh.me/
I did this build bot in a way so it is easy to add new ROMs, so don't hesitate asking for new ROM/devices support.
Supporting new devices might mean some additional work on http://github.com/seSuperuser/super-bootimg/ if they are using non-standard boot.img format, but the aim is to support as many devices as possible.
You need to install the APK from PlayStore afterwards: https://play.google.com/store/apps/details?id=me.phh.superuser
Bot-supported devices
Here are some devices, but there are many more !
- A *lot* of Archos devices
- All Nexus-es, including Pixel C (if some Nexus is missing, just ask!)
- nVidia Shield TV
- nVidia Shield Tablet
- Fairphone 2
update.zip format
The zip is available at https://superuser.phh.me/superuser.zip
It should be able to root any device supported by super-bootimg from TWRP (and possibly other custom recoverys)
You still need to install the APK afterwards. https://play.google.com/store/apps/details?id=me.phh.superuser https://f-droid.org/repository/brow...lob/master/known-imgs/nexus/hammerhead/MRA58N describes a firmware, nothing device-specific). This only requires to do some PRs to add a device, or on updated firmwares
- Testers
- UI designer: The current UI dates back from 4.1...? It is really ugly and not really usable.
- Testers
- Root-related devs: SELinux policies are still being written
- Testers
- Security reviewers
- Testers
Bug report
If some app doesn't work, please ask me, not the dev.
I consider I have to fix support for other apps, not the other way around.
ChangeLog
2016-01-31 r170: superuser.zip can be included in other update.zip
2016-01-27 r166: Add support for Viper4Android
2016-01-15 r162: Add su --bind and su --init commands
2016-01-10 r154: Files are no longer copied multiple times. Fixes MultiROM, and multiple install for update.
2016-01-06 r152: Fix support for ChromeOS-like format (Pixel C)
2016-01-01 r144: Detect chromeos-style signature, and don't try to resign it in that case
2015-12-30 r143: Improved compatibility with apps.
2015-12-28 r142: Changed naming convention to include device name and release
2015-12-28: Added "nocrypt" target
2015-12-13: Added "noverity" target to buildbot
2015-12-13: Add options for noencrypt, noverity
2015-12-03: Fix TitaniumBackup
2015-11-24: mount --bind to /system/xbin/su if it exists to override ROM's su
2015-11-23: Fix CF.Lumen
2015-11-14: Add super-bootimg's version in boot.img, several network/firewall-related permissions
2015-11-11: Access to Android's services
2015-11-10: Recursive su access
2015-11-09: Fix pm disable command
Do you mean that latest galaxy s5 neo sm-g903f might be rooted soon ?
(Exynos5 & Mali T-720)
It seems like many people still haven't understood the purpose of apps like SuperSu and Superuser. They are no exploits and don't gain your root access. What they do is they manage the root access and enable you to select which apps to grant root access, otherwise every single application on your device would have it. They are root managers. So this project won't help you in getting root for your device as long as there's no method (exploit) to gain it.
Not much activity here, but a lot on my side.
Android 6.0 is now out, with its new SELinux policy, which makes it impossible to update the policy after the boot, and dm-verity becomes mandatory (so no /system change without boot.img)
I'm thus totally retargetting my work:
- I've created https://github.com/phhusson/super-bootimg which will edit boot.img (the complicated part, because it needs A LOT of testing across many devices)
- change sepolicy
- Add su in /sbin/su
- Enable su daemon
With various options to disable dm-verity, encryption, etc. (please note that this is NOT required, since only boot.img is changed)
dude - you should kickstarter this. SuperSu is pretty much a mandatory install for every rooted device. this is big for the XDA community and we would love to support you.
Cannot express enough how much i want this project to succeed
And, at least for myself
"I also wonder about displaying an user-understandable SELinux policy, so that root applications can be "more secure
Would anyone be interested in such a feature?"
......Hell yeah, that most certainly does interest me.........controllable levels of su right?
Obviously, if its possible to do........even if android denies this possibility, an open source su is most assuredly welcome from this neck of the woods
I wish this project major luck
Edit
"(I'm thinking that I'm trying to be even more secure than "standard" non-rooted ROMs, that's perhaps a bit optimistic.)"
I love that mentality, and im enjoying immensley your discussions on github with lbdroid........i love that your taking security more seriously then most...love where your coming from on this.....major props
To better test on shell of recovery without making an update.zip , I modified the sepolicy-inject.c so that the usage() no longer blocks the "booting.sh"
on sepolicy-inject.c:377, insert a line "if ( NULL == optarg ) break;", as in my shell there will be a parameter value with null on last entry of "char** arguv", which will trigger the default switching case and exit the sepolicy-inject unexpectedly.
......
while ((ch = getopt_long(argc, argv, "a:f:g:s:t:c:Z:z:n", long_options, NULL)) != -1) {
if ( NULL == optarg ) break;
switch (ch) {
......
kennylam said:
To better test on shell of recovery without making an update.zip , I modified the sepolicy-inject.c so that the usage() no longer blocks the "booting.sh"
on sepolicy-inject.c:377, insert a line "if ( NULL == optarg ) break;", as in my shell there will be a parameter value with null on last entry of "char** arguv", which will trigger the default switching case and exit the sepolicy-inject unexpectedly.
......
while ((ch = getopt_long(argc, argv, "a:f:g:s:t:c:Z:z:n", long_options, NULL)) != -1) {
if ( NULL == optarg ) break;
switch (ch) {
......
Click to expand...
Click to collapse
I'm not sure I understand...
When calling what command do you need this?
phhusson said:
Hi,
IT MIGHT BRICK YOUR DEVICE.
Always ensure you have a way back.
I'm the author of a fork of Koush's Superuser, to handle SELinux: https://github.com/phhusson/Superuser
It is in early-stage, but thanks to recent events related to SuperSU, it got some spotlight.
So I would like your help to make this SuperUser a proud opensource SU app!
I have mostly two sides of things left to do:
- Device compatiblity/update.zip
- Application compatbility
I've tested my Superuser on Qualcomm/CAF 5.1 devices, on MTK 5.1 devices, on CAF 6.0, on Nexus 5/9 6.0, and I believe it should work on most devices which are close enough to AOSP.
I have missing steps to be compatible with SuperSU (see https://github.com/phhusson/Superuser#todo-list ).
I'd like to have feedback from app developers about which features they need the most.
If you have an application that requires root, and which needs specific SELinux configuration please ask!
There are main two types of builds, and some sub-types in it:
- @doitright did an integration in an AOSP tree, to make it suitable for ROM integration, https://github.com/lbdroid/AOSP-SU-PATCH/
- I did http://github.com/phhusson/super-bootimg/ which integrates su in a binary boot.img, and outputs a root-ed boot.img
@doitright's source solution currently has one SELinux policy, which is fully enforcing, and currently works in most cases.
My solution currently has two different policies, one which has su permissive, meaning it can do anything, which is not as safe as source-based s solution, and one which is WIP (basically unusable, because almost nothing is allowed to root).
I setup a build bot, which generates boot.img based on my solution, and pushes them to https://superuser.phh.me/
I did this build bot in a way so it is easy to add new ROMs, so don't hesitate asking for new ROM/devices support.
Supporting new devices might mean some additional work on http://github.com/phhusson/super-bootimg/ if they are using non-standard boot.img format, but the aim is to support as many devices as possible.
The plan is to have a third method for rooting:
super-bootimg will work from a recovery, so that you can root any ROM from recovery.
Thanks !
Click to expand...
Click to collapse
my question is how to change a file label to u: object_r:system_file:s0
i modify system.img to add some additional apps into /system/app/ directory i did modification then build a new system.img after flashing phone with new system.img the app was appear in menu but once i am trying to open it gives me error (com.xxxxxx.andriod) stopped working then i execute ls -Z command in /system/app/ directory to see the different and i realize that the new app i copied in system/app/ directory it has a different label than others
so i tried to change .apk file label to (u: object_r:system_file:s0) using chcon command but failed
chcon: Could not label u: object_r:system_file:s0
can you please guide me how to do it ?
zameer_yus said:
my question is how to change a file label to u: object_r:system_file:s0
i modify system.img to add some additional apps into /system/app/ directory i did modification then build a new system.img after flashing phone with new system.img the app was appear in menu but once i am trying to open it gives me error (com.xxxxxx.andriod) stopped working then i execute ls -Z command in /system/app/ directory to see the different and i realize that the new app i copied in system/app/ directory it has a different label than others
so i tried to change .apk file label to (u: object_r:system_file:s0) using chcon command but failed
chcon: Could not label u: object_r:system_file:s0
can you please guide me how to do it ?
Click to expand...
Click to collapse
Can you check in audit log?
How did you put the file?
Don't you have any other message?
Maybe in your intro you can eloborate on the naming convention of your bot built .img’s?
one which has su permissive (power?), meaning it can do anything, which is not as safe as source-based s solution (user?), and one which is WIP (eng?)
Your HTTPS link to superuser.phh.me is refusing connections?:
This webpage is not available
ERR_CONNECTION_REFUSED
ReloadHide details
Google Chrome's connection attempt to superuser.phh.me was rejected. The website may be down, or your network may not be properly configured.
Check your Internet connection
Check any cables and reboot any routers, modems, or other network devices you may be using.
Allow Chrome to access the network in your firewall or antivirus settings.
If it is already listed as a program allowed to access the network, try removing it from the list and adding it again.
If you use a proxy server...
Check your proxy settings or contact your network administrator to make sure the proxy server is working.
If I do a flash-all.sh of mra58r, reboot to bootloader, fastboot flash boot your-boot.img, would you expect this to boot fine?
Can you detail which phones can take a custom keystore?
For https, I know it is a must, but i'm waiting for let's encrypt.
For naming convention, I have to rethink those, and i'll update first post.
Anyway it's user < power < eng.
User has only safe permissions, power has all known permissions, eng is permissive. There is nothing source based.
For custom keystore, at the moment I have only seen CAF 5.1/6.0 bootloader with verity enabled to work, and it doesn't display key ID, so it is useless everywhere.
I should get a hand on a Nexus 5X soon, to test properly and get screenshots if it works as advertised.
For your last question, yes. I always work with factory image's partitions, and only change boot.img
I welcome any suggestion about naming convention.
Some times I dont know where to post, here or the Nexus 6 doitright thread. Anyway, I found this interesting.
http://events.linuxfoundation.org/sites/events/files/slides/ABS Lollipop MR1 Verified Boot.pdf
"• We relax some security policies in eng/userdebug loaders to make life less annoying for development • Persistent Data Block ignored, device always unlockable"
If this is true of the boot.img's you build, the only one we could trust is user or are they talking bootloader? Maybe the factory bootloader (user) that google is distributing does not have the verification functionality? Is the bootloader AOSP? If so, what would prevent someone from creating a bootloader, boot.img and /system that circumvents all the verification?
I used your bot built mra58r.
Unfortunately, if forced encryption is on, local.prop does not get parsed and I dont get my custom LCD. This means unless you offer variants of the auto built boot.img with forced encryption off or the ability to pass a noencrypt parameter to the update.zip or build.sh for modifying fstab, I will be forced to modify source and build myself. As for mount -o bind /data/local/tmp/hosts /system/etc, as long as the custom hosts has chcon ubject_r:system_file:s0, things work great.
I still like idea of having the ability to establish a trust between boot.img and a config file in /data/ that do things like custom hosts file, lcd density, iptables (one of my favorites: iptables -t nat -A OUTPUT -p tcp --dport 53 -j DNAT --to 8.8.8.8:53; iptables -t nat -A OUTPUT -p udp --dport 53 -j DNAT --to 8.8.8.8:53)
havealoha said:
Some times I dont know where to post, here or the Nexus 6 doitright thread. Anyway, I found this interesting.
http://events.linuxfoundation.org/sites/events/files/slides/ABS Lollipop MR1 Verified Boot.pdf
"• We relax some security policies in eng/userdebug loaders to make life less annoying for development • Persistent Data Block ignored, device always unlockable"
If this is true of the boot.img's you build, the only one we could trust is user or are they talking bootloader? Maybe the factory bootloader (user) that google is distributing does not have the verification functionality? Is the bootloader AOSP? If so, what would prevent someone from creating a bootloader, boot.img and /system that circumvents all the verification?
Click to expand...
Click to collapse
They are talking about the bootloader, but as it is built in the Android build system, they are using Android build system flags.
I know the Nexus 6/9 doesn't have this functionnality. I'm waiting to get a Nexus 5X in my hands to say for 5X/6P.
Either way, we can't circumvent the verification, all we can do is have a YELLOW state instead of ORANGE, which displays the fingerprint of the keystore.
I forgot this presentation from Intel, so I thought I'd give it a try on Nexus Player. Intel has a proper implementation of the bootloader of Google's recommendation, it sounds logical the Nexus Player would implement it.
Oh wait. Google's logic striked again. No they didn't implement it on Nexus Player.
There is no AOSP bootloader... Or there are three (there are two LK and one u-boot), but neither of them are supported, and neither of them support the different verified boot states.
CAF bootloader handles the four states, but doesn't display them. Thanks to you I checked Intel reference bootloader, and it DOES implement the full spec \o/. Though I have no device to test. But basically, there is no opensource arm bootloader implementing it, and that makes me rant a lot against Google.
havealoha said:
I used your bot built mra58r.
Unfortunately, if forced encryption is on, local.prop does not get parsed and I dont get my custom LCD. This means unless you offer variants of the auto built boot.img with forced encryption off or the ability to pass a noencrypt parameter to the update.zip or build.sh for modifying fstab, I will be forced to modify source and build myself. As for mount -o bind /data/local/tmp/hosts /system/etc, as long as the custom hosts has chcon ubject_r:system_file:s0, things work great.
Click to expand...
Click to collapse
Two sides:
1. For LCD density, have you tried just doing adb shell wm density? Possibly it doesn't even break SafeNet
2. My plan on the matter is to keep my current builds as is, but add a configuration file, and when I'll make an update.zip, the user will be able to change the config file directly in the update.zip
I still like idea of having the ability to establish a trust between boot.img and a config file in /data/ that do things like custom hosts file, lcd density, iptables (one of my favorites: iptables -t nat -A OUTPUT -p tcp --dport 53 -j DNAT --to 8.8.8.8:53; iptables -t nat -A OUTPUT -p udp --dport 53 -j DNAT --to 8.8.8.8:53)
Click to expand...
Click to collapse
Well for iptables, I put it in standard su permission. Well ATM because of some bugs it's only in "power", but I expect it to get into "user" when a bug concerning pts is fixed.
phhusson said:
Two sides:
1. For LCD density, have you tried just doing adb shell wm density? Possibly it doesn't even break SafeNet
Click to expand...
Click to collapse
Yay! As su in Terminal Emulator, wm density 360 worked. The launcher didn't work until #am start -c android.intent.category.HOME -a android.intent.action.MAIN and other apps also needed to be killed before they would display at the new density like lock screen and existing notifications. There are a few issues with the status bar and nav buttons depending on what app you try to run. I assume that if you set this early enough with a hook from init.rc, (nudge nudge) say a trusted file from /data/ that there would be no problem.
LCD density set from setprop, local.prop and wm density all break SafeNet. Even worse, SafeNet now checks /sbin/ for su, requiring a mount bind to a copy of sbin without su. Next thing you know, it will check for bind mounts!
How about a build of SuperSU, su in a random directory with random names? I know, name it the hash of boot.img or the public key from the user generated keystore.
Dont read on, I fixed it , the /data/setlcd.sh 560 needed quotes around it.
I created a Terminal Emulator widget in an attempt to make it easy to switch between resolutions. Interestingly, when set with #wm density 360 and then #am restart, the density sticks across reboots, I was not expecting that!
Ive tried the widget with different combinations of explicit paths for su with options like --context and -c with wm density and am restart and even with a /data/setlcd.sh that is chmod 750 and chcon ubject_r:system_file:s0. Any tricks to accomplish this? I would expect the widget to prompt for root permission and then run my setlcd.sh taking the DPI as argument $1 I am envisioning one main .sh that has a function for each of my customizations, wm density, hosts, iptables and mount bind to a /sbin that has no su. I dont want to keep building boot.img's with special init.rc's.
The closest I have gotten is a widget with command /sbin/su with the arguments -c /data/setlcd.sh 560
This results in a terminal launching that asks for su permission and then:
$"/sbin/su" -c /data/setlcd.sh 560
sh: /data/setlcd.sh: can't execute: Permission denied
nothing in dmesg
Click to expand...
Click to collapse
So I made a test of verified boot feature here: http://forum.xda-developers.com/and...rified-boot-disk-encryption-testings-t3248161
The tl;dr is that verified boot is IMO a great feature of 5X/6P, and we have to find a way to have su enabled with this feature.
But this requires to have working OTA.
I have finally gotten the functionality I need with the exception of iptables which I understand you are working on adding. I am testing with shamu mra58r and the boot-su-power.img.
Here is my setup that features:
custom hosts file for browsing without advertisements
set the LCD density to tablet mode
quickly disable su and revert density when I want to use Android Pay
As root, I created a script in /data/android.sh and set the context to system via chcon ubject_r:system_file:s0 and chmod 700 here are its contents:
Code:
#!/system/bin/sh
#bind mounts transcend am restarts
#wm density transcends reboots
function lcd
{
/system/bin/wm density $density
/system/bin/sleep 3
/system/bin/am restart
}
function hosts
{
mount -o bind /data/hosts /system/etc/hosts
}
function nosu
{
/system/bin/wm density 560
cp /sbin /data/sbin -r
rm -f /data/sbin/su
mount -o bind /data/sbin /sbin
/system/bin/am restart
}
function dns
{
#not working yet in phh
iptables -t nat -A OUTPUT -p tcp --dport 53 -j DNAT --to 8.8.8.8:53
iptables -t nat -A OUTPUT -p udp --dport 53 -j DNAT --to 8.8.8.8:53
}
density=$2
case "$1" in
lcd) lcd ;;
hosts) hosts ;;
nosu) nosu ;;
dns) dns ;;
esac
The hosts file was copied from http://winhelp2002.mvps.org/hosts.txt and placed in /data, its context was also set chcon ubject_r:system_file:s0 and chmod 644. The local host entries were modified to match those found in /system/etc/hosts. It was important that the contents of this file were terminated on each line and with a blank line at the end.
The tricky part was creating launchers on a home screen using the Terminal Emulator Widget. It seemed that you could not just type in /sbin/su, instead you had to browse to it. Screenshot of widget config attached.
I learned a few interesting things during testing.
Using a /data/local.prop with an encrypted disk resulted in the local.prop not being read during init.
Once wm density is set, it is persistent.
Using mount -o bind gives persistent mounts if you reboot using am restart from the terminal
SafetyNet now checks for su in /sbin
SafetyNet for AndroidPay checks for LCD density regardless of setting it via local.prop (if unencrypted), setprop or wm density
This will be easy for me to reproduce across all my devices without granting persistent root to any app and without adding any app but superuser and terminal emulator.
Thanks for your test! It's really interesting.
You must be the first user of something other than eng
iptables does work for me (in adb shell). Looking back, it should have been fixed by https://github.com/phhusson/super-bootimg/commit/31d3a635eea4fe66071346e05913acfb00d60144
That made me realize that if I don't do releases, I still need to know what users are using, so I added /super-bootimg which contains the git version of super-bootimg repo
For local.prop I'm happy to see you don't need it. I really feel like user shouldn't be allowed to change it (but I'm thinking only about some properties which are in /default.prop so it can't be overriden. perhaps local.prop is safe enough)
am restart is not a reboot, so it's normal mount bind stays
I think you could just mount bind an empty folder to /sbin. The only risks are if adbd/ueventd/watchdogd/healthd restarts, but they shouldn't
Any idea why busybox nslookup is not working?
[email protected]:/data # ls -Z nslookup busybox-android.bin
lrwxrwxrwx root root ubject_r:system_data_file:s0 nslookup -> busybox-android.bin
-rwxr-xr-x root shell ubject_r:system_file:s0 busybox-android.bin
[email protected]:/data # ./nslookup superuser.phh.me 8.8.8.8
Server: 8.8.8.8
Address 1: 8.8.8.8
nslookup: can't resolve 'superuser.phh.me'
1|[email protected]:/data # dmesg
[39764.686702] healthd: battery l=91 v=4144 t=28.1 h=2 st=3 c=-439 chg=
[email protected]:/data #