Help with SELinux - rooting a new device - Android Software/Hacking General [Developers Only]

Help with SELinux - rooting a new device - Android Software/Hacking General [Developers Only]

Evening all,
I have a Vivo V3 Max (www.vivoglobal.com) which runs Android 5.0.1 (no Marshmallow ROM yet!). It has never been able to be rooted and I am on a mission to do it.
The progress I've made so far is as follows:
1. Got a custom TWRP recovery image flashed and working on the phone so I can boot into recovery. This recovery has full root access to everything.
2. Modified the boot image so that ADB runs as root (insecure mode). This allows me to have a full root shell via ADB when the phone has fully booted as normal. Also modified the fstab to make /system world writable.
3. Installed various "recovery flashable ZIPs" to no avail - it puts all the files (su in /system/xbin etc) in the right place but still no root access.
4. Manually created the required files and symlinks myself, which resulted in the same as 3) above.
I am now at the stage where I realise that it's SELinux not allowing the full root to go through in normal userspace. I can run setenforce 0 (and also su 0 setenforce 0) via ADB to make SELinux permissive, but still I get "/system/bin/sh: su: Operation not permitted" when running SU from a Terminal Emulator app.
Is there anyone out there who can help me with the SELinux side of things to allow /system/xbin/su to run? Also tried systemless with Magisk but same result. Vivo do not release kernel sources for any of their products so I'm stuck with what I have. I do at least have read/write access to all partitions on the device though, so if theres any modifications I can make then I'm happy to try them. I have a full NAND backup of the entire thing.
I have tried using supolicy etc to inject rules, but I'm not really sure what I should be injecting.
Any seasoned developers willing to help me out? My background is in PHP, C#, VB.NET and Windows Servers but I'm OK with Linux too.
Many thanks!

I have attached the output on supolicy --dumpav in case it is useful.

Just a quick update on this... I managed to find a ROM for a very similar device hardware-wise, which was pre rooted. After tweaking the boot image to allow it to run on my device, I could see that /system/xbin/su still had no permission to run. This was despite the fact that the security policies from the other device was copied directly to mine, and on that other device full root access is possible using the exact same ROM that I ported.
I am therefore left with the conclusion that it doesn't matter how many rules I inject to sepolicy or how many domains I modify, the kernel is the limiting factor here. Since Vivo do not release the kernel sources for any of their devices I guess I'm screwed. Would this be against the GPL and is something I can take up with Vivo? I'm gutted...

Related

!!!Possible Perm Root Within Reach!!! 4-5-2019

I would like to share some info I have garnered from various forms of testing and such. I know a guy with a newer alcatel brazilian only model running android 6. We have been trying to get into the phone for a while. mtk-su was the way in to begin with. since it's a newer phone, it has decent security. system somehow gets mounted to zram so any changes made to system get erased at boot. System is ro and can't be changed perm as of yet. A script was created that basically spams mount system rw, which allows a few second gaps of system being rw, long enough to push some supersu files and start the daemon. Now, pushing strictly supersu files and then opening supersu will get the update binary request, which does not complete, and canceling the update still doesnt allow the installed su binary to work, so no temp root. Basically supersu is a no go. Now fast forward ahead a bit of time., and this is what the process is looking like.
Use mtk-su to grant ADB shell temp root
run the script for system rw from that temp root adb shell
squeeze the supersu files minus su to their locations using the small system rw gaps and also rename mtk-su to su and push that where it goes
give those pushed files correct permissions
start the su daemon
Temporary Paydirt!!
you now have temp root on a ro system, locked bootloader, all security in place. You are bypassing the need for supersu all together as you have temp root that doesnt ask for permission. any app that wants root gets it automatically.
that makes a guy wonder what flashfire would do, could you flash proper supersu that way and have it be systemless?
can you run selinux switch and have selinux be permissive
on a non zram system setup, could you gain perm root by not having system reloaded every time
could you somehow get to and mount the real system(location of real system is known: mblck25 or something) on a zram system setup and then gain perm root
Anyways, this is just something that's been banging around in my head, slowly spilling out, with small strides being made. Alot of testing still needs to be done, the process tweaked and refined and alot of sleepless nights i'm sure. Any thoughts, opinions, ideas, help is surely welcomed and needed. Once i have a dedicated tester on board and exhaust all possibilities and get the process to a good point, i'll release what I have. Until then, rest assured that I am doing what i can, for a phone i don;t own. The good thing is that this will potentially work on any device that mtk-su works on, which at this point is turning out to be a very decent amount of MTK devices

Mount /$y$tem a$ -rw
What i$ the $cript?

[ROOT][SamPWND][N960U][WIP-Combo Needed]

Hello XDA!
Samsung has been semi SamPWND again!
Disclaimer:
This root method was developed and tested on the N960U model. This is the only model I have that is a Samsung device. I do have friends and other devs however that have tested this method on various other Samsung devices on both Qualcomm and Exynos chipsets and it has worked on a good number of them meaning this method is not limited to the Note 9. With that being said, due to all the time I have already spent on this and not having any other devices, I will ONLY be supporting the N960U. So do not get upset if I do not respond to you if you have a Samsung A8934839K312 on 7.1 Android (aka a device I have never even heard of before.)
Disclaimer 2:
This root method is mainly for dev's or those who like to tinker and figure things out. The reason I say this is because at this time, you are REQUIRED to be on a factory/combination firmware to mess with the root method. I will ignore any comments/questions for people who do not read this disclaimer and ask me how to root stock etc. as that is what I have been trying to do for over a month now. If you need your phone for work or a daily then I suggest only messing with this root method if you have a lot of spare time since it involves flashing combo firmware at which mobile services and other stuff will not be functional. You have been warned!
Disclaimer 3:
This thread/poc are essentially to get you the ability to use root apps and have a root shell, that is it. If I have time and see some questions that are legit questions I will try to provide help in a timely manner. This POC simply pushes busybox binary from Magisk.zip and SuperSU (the last version chains released before retirement) and installs it in sbin/daemon mode. There is also a way to install MagiskSU in daemon mode as well as ways to install root to /system/xbin for example and do mods such as Xposed that typically need to modify the system partition but that is not the purpose of this thread and these methods are a bit more involved (require modifying the root script as well as setting up bind mounts and other stuff.) Hopefully once this is released and some devs chime in I hope there will eventually be others contributing with various root scripts, install methods etc. and of course HOPEFULLY find a way to write to system/odm/vendor partitions so we can eventually run root on stock!
Disclaimer 4:
I am NOT responsible if you break your phone, wipe your IMEI, hard brick etc. etc.! Also, I spent months to get to this point and already had someone steal my files from AFH (I know, my fault for not hiding them) so please do not take my work as your own. If you want to use it in any way/shape/form just ask for permission and/or give credits in your thread is all I ask! If you are however using someone else's modified files and in here trying to get help I might turn you away (back to the person who provided the modified files) just an FYI!
I think that is enough disclaimers for now!
Note: This thread will most likely be ugly for a bit as I am terrible with making these things look pretty... Hopefully as time goes I will keep improving it or find someone who is trustworthy I can make a "contributor" so they can fix it up for me haha.
Now, Let's Get To It!
Technical Details:
This is sort of a spawn from an exploit I found and reported to Samsung back on the Tab S3 that I never released on XDA. That method (long story short) involved modifying the Persist partition and flashing it in ODIN as ODIN did not check it for integrity. Of course it was patched by Samsung who gave me some $$$ and gave me a shout out on their security bulletin which was pretty cool!
This method is similar to "Persist Root" except we are not flashing any modified partitions in ODIN. Instead, on many Samsung combination firmwares there is an init rc script on /system. If you want to know if your device is compatible a good starting point would be to look for a file called "init.lab.rc" which is typically located at "/system/etc/init/init.lab.rc" like so:
-rw-r--r-- 1 root root ubject_r:system_file:s0 14784 2008-12-31 10:00 init.lab.rc
As it stands, we cannot edit this script. I noticed something cool however when I was reading it one day. Specifically one thing that caught my eye was this:
chmod 777 /data/lab/run_lab_app.sh
There are MANY files and scripts at /data/lab. Luckily, the init.lab.rc sets permissions to "0777" and sets ownership to system on the entire /data/lab directory! If you are still with me, this means all the contents of this directory are world readable/writeable and we can modify any of the files in this DIR without elevated privileges!
Now I am showing the "run_lab_app.sh" script specifically for a reason. We know we can modify any scripts on /data/lab, but how can we execute it with elevates privileges? Going back to the init.lab.rc, if you scroll to the bottom of the rc file you will see this:
service start_abc /system/bin/sh /data/lab/run_lab_app.sh factory abc+
user system
group system
disabled
oneshot
on property:sec.lab.abc.start=1
start start_abc
setprop sec.lab.abc.start 0
Now what that means is, when you set the property "sec.lab.abc.start" to "1" it executes the abc service as system user and more specifically it will start by executing the "run_lab_app.sh" script! Therefore, after you modify the script to your liking, push it to /data/lab/run_lab_app.sh, then do a "setprop sec.lab.abc.start 1" your script will be executed as system user!
Now system obviously is not "root". Now that we can execute as system user we have more attack vectors to elevate privileges even more. Ideally, I remembered how I rooted the Tab S3 about a year ago using Persist partition. As it stands, we are not able to read/write on persist. If we were to set permissions however on /persist using the run_lab_app.sh script, then we can gain access to it! Therefore, one would only need to add this command to the run_lab_app.sh script and execute it using the setprop command:
chmod -R 0777 /persist
As soon as you modify the script, push it and execute the setprop command, it will change permissions on the /persist DIR to be world readable/writeable!
Now, the reason why I like to use Persist, there is a script that is executed by INIT on every reboot automatically (this means it is executed by root!) The script in question is this one "/persist/coresight/qdss.agent.sh." (I am not sure if this script itself is a Qualcomm specific script or not.) Modifying this script has no ill effects on anything from what I have seen.
Now to see how the script is executed you can look in "/vendor/etc/init/hw/init.qcom.test.rc" and you will see some interesting stuff including this:
crownqltesq:/vendor/etc/init/hw # cat init.qcom.test.rc | grep persist
service cs-early-boot /vendor/bin/sh /persist/coresight/qdss.agent.sh early-boot /vendor/bin/init.qcom.debug.sh
service cs-post-boot /vendor/bin/sh /persist/coresight/qdss.agent.sh post-boot /vendor/bin/init.qcom.debug.sh
write /persist/coresight/enable 1
write /persist/coresight/enable 0
crownqltesq:/vendor/etc/init/hw #
As I stated earlier, due to this init script, the qdss.agent.sh script is executed by init context/root user automatically during early boot and post boot. This means once you get everything set up, you won't need to keep reinstalling root (unless you mess something up) on each reboot. This is ideal since we don't have a way yet to modify system/vendor/odm partitions yet. Think of it as a "systemless" root.
For the POC I have provided in this thread for example, it contains the bare minimum SU files. The files in the attached zip are simple: SamPWND.bat, sampwnd1.sh, sampwnd2.sh, /sampwnd which contains su, sukernel, supolicy, libsupol.so and busybox. The way it works is this:
1) You double click the .bat file and it should do everything for you! The .bat file will:
- Push sampwnd1.sh to /data/lab/run_lab_app.sh
- Execute the lab script by doing "setprop sec.lab.abc.start 1"
- Push sampwnd2.sh to /persist/coresight/qdss.agent.sh
- Push root files in "sampwnd" folder to /persist/coresight/sampwnd
- Set permissions on the files we just pushed to Persist to 0777
- Reboot the device (Note: The .bat file reboots the device at this point since everything is in place to root when the device reboots, it's that simple!)
After the device reboots, you should now be able to use a root shell as well as sideloading any root apps will work (apps such as TiBu, Root Explorer, Flashfire etc. etc.)
When the device reboots, the qdss.agent.sh script does the following automatically:
1) Mounts rootfs and sets permissions to 0777 so we can access /sbin
2) Pushes the contents of the root files folder "sampwnd" to /sbin
3) Sets permissions to the files we just moved to /sbin
4) Exports the LIB path to /sbin due to the libsupol.so being needed to patch the sepolicy with supolicy
- The export command is "export LD_LIBRARY_PATH=/sbin"
- Once the script is over and you use another app or go into a shell etc. the LIB path will be gone/reset so you don't need to
worry.
5) Patches the sepolicy for SU
6) Installs SU by executing "su --install"
7) Executes the SU daemon by running "su --daemon"
8) Lastly, remounts rootfs back to RO.
As stated earlier, these commands are all automatically executed by init/root each time you reboot the device. Essentially, whatever we put into the qdss.agent.sh script will be executed on boot by init/root. If for some reason permissions are lost, we should still have our lab script and we would only need to run "setprop sec.lab.abc.start 1" to change permissions on persist again!
The initial files I provide today are just a simple root install script. I have successfully used the root script to install MagiskSU, Xposed (using bind mounts to overlay on /system) and other tests. I also at one point made a backup script that backed up all the partitions on the device into a folder which I extracted to my PC for safe keeping, you get the picture! Once you have root however, you can do these things easier as you will have root access.
Now that you know the workings of the exploit (err exploits?) I will explain briefly what is needed and how to test it.
Pre-requisites:
1) Download links will be in 2nd post.
2) For the purpose of this thread and the only device I personally have, you should have a N960U/U1/W on a rev1 bootloader (there isn't a rev2 BL yet so most should be good to go.)
3) A vulnerable Combo Firmware. I linked the one I use in Post 2. I use 1ARG4 Factory/Combo firmware. Of course you will need ODIN to flash the combo.
4) The root files/7z linked in post 2.
5) Stock firmware for when you are done playing, testing, etc. etc.
6) Almost forgot, you will need ADB. I will not go into details on this, if you don't have a working ADB Google is your friend. I recommend setting it to your path so you can use ADB from anywhere on the PC.
Install Instructions:
1) Extract the root files 7z into a DIR of your choice.
2) Flash whichever vulnerable combo firmware you are using via ODIN.
3) Once it boots up, make sure your device is seen by adb by running "adb devices"
4) Double click the .bat file.
5) That's it! Your device will reboot and you should be rooted!
If for some reason it is not working and you are on a N960U/U1/W, there could be a number of reasons. If you are not using the 1ARG4 combo I linked then it's possible the combo you are using is not vulnerable. It could also be an issue with ADB. Sometimes if things get crazy throughout your testing you might need to reflash /persist in ODIN or reflash the combo firmware in ODIN then re-run the .bat file (I only experience this typically when I get crazy with the root script and end up losing permissions to everything or something I added in the root script is causing the device to boot-loop etc. etc.)
Now donations are not required but feel free to throw me some beer money if you want! My paypal email/link is in a few places, you shouldn't have any trouble finding it!
TELEGRAM GROUP IS COMING REAL SOON!
We will use the TGRAM to provide support, ideas, share scripts/files and HOPEFULLY, we can all figure out together how to turn this into rooting the stock firmware as this is the goal and will be the primary focus of the chat!
Credits:
@samsung - for letting us PWND them time and time again!
@chainfire - SuperSU of course
@topjohnwu - MagiskSU of course
@me2151 - For all the time and help he is going to be putting in with us! Such a great guy! lol
@jrkruse - For everything! Everything from EDL support, ROM support, Root support you name it!
@partcyborg - For also spending countless hours helping answer questions in here so I don't have to hahah
@mweinbach - He writes great articles for XDA! He is a good kid who gets his hands on cool things frequently
@"mysecretfriendfromfaraway - I will not name him haha, he knows who he is. He always helps out and gets great things!
XDA:DevDB Information
SamPWND N960U Root, Tool/Utility for the Samsung Galaxy Note 9
Contributors
elliwigy
Version Information
Status: Testing
Created 2019-05-05
Last Updated 2019-05-05

[ROOT][SamPWND][N960U][WIP-Combo Needed]

Root any device just using ADB Shell.

In this post, I'm not telling any tricks or methods. I am just providing my thoughts and possibilities. Recently I was trying to root my phone and I did a little bit of research on it. By the way, note one thing here that my phone is part of the Android One project and made by Xiaomi, so it's much harder to root than any other phone. If you have also tried to root your phone, then you might have also heard these words... (Magisk manager, Superuser, Busybox, SU Binary, TWRP Custom recovery, root file, System file, Custom Rom), etc. In this thread, if I am right you can root your phone just by using ADB Shell. Rooting your phone means...
Rooting (Android)
From Wikipedia, the free encyclopedia
Rooting is the process of allowing users of smartphones, tablets, and other devices running the Android mobile operating system to attain privileged control (known as root access) over various Android subsystems. As Android uses the Linux kernel, rooting an Android device gives similar access to administrative (superuser) permissions as on Linux or any other Unix-like operating system such as FreeBSD or macOS.
Rooting is often performed with the goal of overcoming limitations that carriers and hardware manufacturers put on some devices. Thus, rooting gives the ability (or permission) to alter or replace system applications and settings, run specialized applications ("apps") that require administrator-level permissions, or perform other operations that are otherwise inaccessible to a normal Android user. On Android, rooting can also facilitate the complete removal and replacement of the device's operating system, usually with a more recent release of its current operating system.
Root access is sometimes compared to jailbreaking devices running the Apple iOS operating system. However, these are different concepts: Jailbreaking is the bypass of several types of Apple prohibitions for the end-user, including modifying the operating system (enforced by a "locked bootloader"), installing non-officially approved (not available on the App Store) applications via sideloading, and granting the user elevated administration-level privileges (rooting). Many vendors such as HTC, Sony, LG, Asus, and Google explicitly provide the ability to unlock devices and even replace the operating system entirely. Similarly, the ability to sideload applications is typically permissible on Android devices without root permissions. Thus, it is primarily the third aspect of iOS jailbreaking (giving users administrative privileges) that most directly correlates to Android rooting.
Rooting is distinct from SIM unlocking and bootloader unlocking. The former allows removing the SIM lock on a phone, while the latter allows rewriting the phone's boot partition (for example, to install or replace the operating system).
Source: Wikipedia
So, as much as I've noticed (I could be wrong) mainly all rooting processes does one of those two things,
1. Edits your boot.img
or
2. Adds a SU binary file to your system & more specifically to your system/bin file.
So if that's true and every Android phone or at least the same brands or same models or at least same Android versions or maybe all of them requires the exact same SU binary file(Superuser binary file). Now, if you don't want to change your boot.img there is only one is remaining and that is adding the SU binary file. Now you might ask how to do that...
Just use your ADB shell to give writing system files permission to your file manager. And then put the SU file to your system.
So, that's all I was just trying to say. Now if I am right please let me know and thanks for reading until now. And also if I am right, please someone provide me the SU binary file of Xiaomi MI A3, code name: laurel_sprout . Thank you once again, All developers, take care of your health. For further inquiries and helping me out, message me on XDA personally.
Writer: Samiullah Ridoy.

Samiullah Ridoy said:
...
Just use your ADB shell to give writing system files permission to your file manager. And then put the SU file to your system.
...
Click to expand...
Click to collapse
Absolutely errleading ( i.e. wrong ) statement:
1. To mount Android's partition /system as RW - so you can copy SU-binary onto it - you need superuser ( SU ) rights.
2. Modern Android versions have SELinux enabled, and most also DM-verity and/or AVB. These safety-features lock the /system partition to get tampered, what at least with regards to SELinux and/or DM-verity only can be disabled by superuser ( SU ).
3. With regards to AVB one has to unlock device's bootloader, too, in order to disable this lock.

@Samiullah Ridoy
As above post said,
-You can't simply give writing system files permission.
-Only emulators have that ability(since they are not production builds)
Here is your device specific guide at Mi A3 forum https://forum.xda-developers.com/t/...-root-mi-a3-with-magisk-without-twrp.3958509/
Rooting your device is same as any other device if we use Magisk rooting method. It does not take additional steps to root your specific device.
Thanks

You need to disable DM-verity.
You can do it from ADB. You need to modify Stock boot image file. Patch it and disable DM-Verity.

HemanthJabalpuri said:
@Samiullah Ridoy
As above post said,
-You can't simply give writing system files permission.
-Only emulators have that ability(since they are not production builds)
Here is your device specific guide at Mi A3 forum https://forum.xda-developers.com/t/...-root-mi-a3-with-magisk-without-twrp.3958509/
Rooting your device is same as any other device if we use Magisk rooting method. It does not take additional steps to root your specific device.
Thanks
Click to expand...
Click to collapse
I have already seen that post & I don't want to do it that way. You said, " You can't simply give writing system files permission. ", I've already mentioned but saying it once again that I could be wrong but we can give writing system files permission by using these code...
Code:
adb shell pm grant [package name] android.permission.WRITE_SETTINGS
adb shell pm grant [package name] android.permission.ACCESS_MEDIA_LOCATION
adb shell pm grant [package name] android.permission.WRITE_INTERNAL_STORAGE
Tell me if I am wrong & thanks for your compliment.

Samiullah Ridoy said:
I have already seen that post & I don't want to do it that way. You said, " You can't simply give writing system files permission. ", I've already mentioned but saying it once again that I could be wrong but we can give writing system files permission by using these code...
Code:
adb shell pm grant [package name] android.permission.WRITE_SETTINGS
adb shell pm grant [package name] android.permission.ACCESS_MEDIA_LOCATION
adb shell pm grant [package name] android.permission.WRITE_INTERNAL_STORAGE
Tell me if I am wrong & thanks for your compliment.
Click to expand...
Click to collapse
I didn't tried those but I am sure those are NOT for writing read-only partitions.
Those are for accessing internal storage and changing settings like brightness I think.

jwoegerbauer said:
Absolutely errleading ( i.e. wrong ) statement:
1. To mount Android's partition /system as RW - so you can copy SU-binary onto it - you need superuser ( SU ) rights.
2. Modern Android versions have SELinux enabled, and most also DM-verity and/or AVB. These safety-features lock the /system partition to get tampered, what at least with regards to SELinux and/or DM-verity only can be disabled by superuser ( SU ).
3. With regards to AVB one has to unlock device's bootloader, too, in order to disable this lock.
Click to expand...
Click to collapse
Absolutely correct.
It seems to me OP has never tried this, simply has copied from other sources. That is why the nonsense.

How do I temporarily root a samsung device running android 9 without twrp recovery?

I have used magisk to patch the file and android platform tools (fastboot or stuff like that) but it does not work. I dont want to install twrp as i dont really trust custom recoveries as much and i dont want to use odin for the same reason. Is this impossible or is there a way but i am just doing it incorrectly. Please reply asap!

Never installed Magisk nor TWRP, why should I have done it?
To answer your question: A temporary root can get achieved by putting a suitable su into directory /data/local/tmp and making it executable.
https://forum.xda-developers.com/attachments/su-binaries-zip.5566949/

xXx yYy said:
Never installed Magisk nor TWRP, why should I have done it?
To answer your question: A temporary root can get achieved by putting a suitable su into directory /data/local/tmp and making it executable.
https://forum.xda-developers.com/attachments/su-binaries-zip.5566949/
Click to expand...
Click to collapse
The data partition is not accessible without having root first. How are they to place su in data partition to gain temp root without first gaining root to place su in data partition? How can they root the device by using a method that requires root in the first place to achieve what you are telling them?

I think the code
Code:
adb push <PATH-TO-SU-ON-PC> /data/local/tmp
always works , because this path ( /data/local/tmp ) is always present and writable on Android dev device and Emulator.
At least it always worked for me since I'm rooting Android this way.

xXx yYy said:
I think the code
Code:
adb push <PATH-TO-SU-ON-PC> /data/local/tmp
always works , because this path ( /data/local/tmp ) is always present and writable on Android dev device and Emulator.
At least it always worked for me since I'm rooting Android this way.
Click to expand...
Click to collapse
do i unroot my device by rebooting it?
p.s. will doing this solution create a possibility of bricking my device?

Technically seen you can't root / unroot a device, but only Android OS.
As with Android OS root ( sometimes called superuser ) is the same as Administrator with Windows OS. Simply adding an user with elevated privileges never will brick an Android device.
Become familiar what root is the world of Linux OS - take note that Android OS merely is a port of it.

xXx yYy said:
Technically seen you can't root / unroot a device, but only Android OS.
As with Android OS root ( sometimes called superuser ) is the same as Administrator with Windows OS. Simply adding an user with elevated privileges never will brick an Android device.
Become familiar what root is the world of Linux OS - take note that Android OS merely is a port of it.
Click to expand...
Click to collapse
so running that command will give me legit root privileges and i can do the things an admin can do without any malware or damage?

Droidriven said:
The data partition is not accessible without having root first. How are they to place su in data partition to gain temp root without first gaining root to place su in data partition? How can they root the device by using a method that requires root in the first place to achieve what you are telling them?
Click to expand...
Click to collapse
so should i really use magisk to root my device?

moutsu said:
so should i really use magisk to root my device?
Click to expand...
Click to collapse
No, try what was suggested by placing su in the data/local/tmp. If that doesn't work, try using magisk to root your device.

xXx yYy said:
I think the code
Code:
adb push <PATH-TO-SU-ON-PC> /data/local/tmp
always works , because this path ( /data/local/tmp ) is always present and writable on Android dev device and Emulator.
At least it always worked for me since I'm rooting Android this way.
Click to expand...
Click to collapse
I've never seen a device rooted by such simple means, in my experience, it has always required root to even access data partition, especially if trying to push/pull files to/from data via adb.
I mean, if it were really that easy, why would all these rooting tools snd methods that exist on XDA have ever been needed to be created?
What devices have you rooted using this method? Can you provide information that explains and confirms what you say?

Hmmmm...
Short checked on my SM-R860 Android 11...
Code:
freshbs:/ $ cd /data/local/tmp
freshbs:/data/local/tmp $ ls
freshbs:/data/local/tmp $ ls -a1l
total 6
drwxrwx--x 2 shell shell 3452 2022-03-25 01:20 .
drwxr-x--x 4 root root 3452 2022-03-25 01:20 ..
Need more time or drinks to place something here...
Waiting for other results...
Best Regards

@Droidriven
Fellow member @adfree has proven that even with Android 11 directory /data/local/tmp worlwide exists and is writeable.
Sometimes it really makes sense to understand what OP wants to achieve: He just wants to know how Android can be temporarily rooted.

xXx yYy said:
@Droidriven
Fellow member @adfree has proven that even with Android 11 directory /data/local/tmp worlwide exists and is writeable.
Sometimes it really makes sense to understand what OP wants to achieve: He just wants to know how Android can be temporarily rooted.
Click to expand...
Click to collapse
I do need to know how an android can be temporarily rooted so I can give certain apps on my phone root access to recover some stuff I accidentally deleted. However, I do need a bit of clarification on what su file I need to put into the directory as the filed you linked was a zip file.
I would also like a method on how to unroot my device.

Dear moutsu...
IMHO instead blabla... IMHO it makes sense to start from scratch with FULL infos.
I can see only bla bla Samsung Device...
Please give full details...
A
Model Name...
Example:
SM-G920F is Android 7 for instance...
B
Is Phone alive... then give full details about Firmware Version.
Easiest way for most infos...
Type:
*#1234#
Type or make Photo or Screenshot...
Best Regards

@xXx yYy
Thank you very much. But...
I clicked through your profile and find some more puzzle parts of your idea...
Learning to root my old Galaxy S4
I have an old Samsung Galaxy S4. It's been off the network for a while and its system clock has drifted. However, adb works and I can use the old phone as a sandbox environment to learn about low level Android fundamentals. I would like to learn...
forum.xda-developers.com
After this I was drunken enough to try few things with my SM-R860...
WITHOUT success...
Later I will add my ADB output... for better understanding...
IMHO I am not total Noob in Rooting something...
Also I have "some" experiences in recover halfdead devices to backup beloved data...
I am sure you have forgotten about Samsung additional Security check... like Knox crap etc...
So my conclusion...
Your method is good to know...
But chance for success in "newer" Samsung devices is not 100 %...
Maybe you can give Samsung model name... where this work?
I could check SM-G920F with Android 7 just for fun... if I have time...
Thanx in advance.
Best Regards

regardless it is writeable to adb shell only (uid 2000), chown is forbidden anyway. even if you set SUID bit that wouldn't make much sense in /data/local/tmp
furthermore, even if you could place su binary in /system (which requires unlocked bootloader + dm-verity patch) it still requires privileged daemon in background where su want connect apps (but not exist).
so this method never worked, except for some ancient android devices where remount /system was possible from adb root.
and we haven't spoke about selinux, yet
Magisk does all this, but requires* unlocked bootloader - which triggers factory reset. So unless you have some nice exploit like dirty-cow or mtk-su, temporary root is simply impossible.
edit: TWRP is not able to decrypt samsung encryption btw. So if you want have access to userdata partition on locked bootloader the only way would be (samsung signed) so called "combination ROM" (with same bootloader level) to be flashed from Odin via HOME_CSC or heimdall.
if your device is ancient old you might lucky bootloader is unlocked, userdata partition is not encrypted at all, and ROM is just signed with test keys. in that case you can flash anything on recovery partition. philz touch recovery even provided flashable zips that signed with test keys, these zips can be flashed straight from stock recovery without PC. I remember temporary zips exist, that only boot into custom recovery without actually installing it.
edit2: *except some Mediatek devices with AVBv1 where one can flash magisk patched boot.img on locked bootloader

My last 2 cents here ( I no longer participate this thread ):
The su ( read: switchuser ) command is used to run an Android system function as a different user. It is the easiest way to switch or change to the administrative account ( read: superuser ) in the current logged in session.
Most versions of Android disable the superuser ( mostly mistakenly called root user - take note that root user in Android is the user with ID 0 who is by default present on all Android versions, is the user of session when Android gets started ) account by default making the system more secure. But, this also restricts the Android user from running specific system related commands.
Using su to temporarily act as a superuser allows you to bypass this restriction and perform system related tasks with different users.
The synthax of su command is
Code:
su [options] [username [[arguments]]
If a username isn't specified, su defaults to the superuser. Now, the logged-in user can run all system commands. This will also change the home directory and path to executable files.
If the su is used to temporarily act the logged-in user as superuser then the su binary can be located anywhere in Android's filesystem, e.g. /data/local/tmp, /storage/emulated/0, etc.pp, it must not be located in Android's system partition.

xXx yYy said:
My last 2 cents here ( I no longer participate this thread ):
Click to expand...
Click to collapse
yes, that's maybe better. teach yourself about android first. android is not linux
What special privileges "/system/xbin/su" does have w.r.t. root access?
This answer says: Because of the way directory/file permissions are configured on Android, you need to have the su binary on your /system partition in order for it to work. Putting elsewhere...
android.stackexchange.com

what is your current bootloader level? combination ROM is available (haven't checked these download links)
https://www.samsungfirmwares.info/samsung-sm-j415gn-combination-firmware-file-rom
my expectation ro.debuggable=1 is enabled
adb root will work on eng build

aIecxs said:
yes, that's maybe better. teach yourself about android first. android is not linux
What special privileges "/system/xbin/su" does have w.r.t. root access?
This answer says: Because of the way directory/file permissions are configured on Android, you need to have the su binary on your /system partition in order for it to work. Putting elsewhere...
android.stackexchange.com
Click to expand...
Click to collapse
Yeah, I get where they were coming from but.....
Nah. It just doesn't work that way for everybody. Like all things android, it really just depends on what device you have and how crappy its hardware/software and security is. Lower end/cheap and old stuff doesn't have as much time invested in making them secure to save on development and distribution costs.
Unfortunately, Samsung just isn't one of those brands that are easily rooted these days, unless you buy specific models with specific firmware/binary combinations.

Database Info

welcome