search

tiann / KernelSU

A Kernel based root solution for Android
https://kernelsu.org
GNU General Public License v3.0
10.43k stars 1.7k forks source link

Realme 5.4 内核su 无法无法提权到 root #320

Closed qiurigao closed 1 year ago

qiurigao commented 1 year ago

KernelSU_bugreport_2023-03-23_21_36.tar.gz

qiurigao commented 1 year ago

Screenshot_2023-03-23-21-20-50-56_baaa51257c82a8b3f281ce09e6f2493f Screenshot_2023-03-23-21-27-26-54_baaa51257c82a8b3f281ce09e6f2493f Screenshot_2023-03-23-21-08-34-21_9e8df3d0c7c1f50248b6ee043a653d26

qiurigao commented 1 year ago

TWRP里抓列下日志 k.log @tiann dmesg |grep KernelSU
[ 1.865376] (7)[1:swapper/0][ 1.865375]@7 KernelSU: ksu_lsm_hook_init [ 1.867087] (7)[1:swapper/0][ 1.867086]@7 KernelSU: sucompat: execve_kp: 0 [ 1.868736] (7)[1:swapper/0][ 1.868735]@7 KernelSU: sucompat: newfstatat_kp: 0 [ 1.870321] (7)[1:swapper/0][ 1.870320]@7 KernelSU: sucompat: faccessat_kp: 0 [ 1.871868] (7)[1:swapper/0][ 1.871868]@7 KernelSU: ksud: execve_kp: 0 [ 1.873466] (7)[1:swapper/0][ 1.873465]@7 KernelSU: ksud: vfs_read_kp: 0 [ 1.877874] (7)[1:swapper/0][ 1.877873]@7 KernelSU: ksud: input_handle_event_kp: 0 [ 1.998919] (7)[1:swapper/0][ 1.998918]@7 KernelSU: KEY_VOLUMEDOWN val: 0 [ 1.998923] (7)[1:swapper/0][ 1.998922]@7 KernelSU: KEY_VOLUMEDOWN val: 0 [ 2.285969] (7)[1:init][ 2.285968]@7 KernelSU: /system/bin/init second_stage executed [ 2.285971] (3)[380:kworker/u24:7][ 2.285970]@7 KernelSU: SELinux permissive or disabled, don't apply rules. RMX2202:/ # getenforce
Enforcing

qiurigao commented 1 year ago

注释掉 https://github.com/tiann/KernelSU/blob/ecd5af76ab87ef322553c86afb205620399e6934/kernel/selinux/rules.c#L41 和 https://github.com/tiann/KernelSU/blob/ecd5af76ab87ef322553c86afb205620399e6934/kernel/selinux/rules.c#L192 后

[ 1.328225] (7)[1:swapper/0][ 1.328223]@7 KPI: Kernel MPM timestamp = 558586 [ 1.328229] (7)[1:swapper/0][ 1.328227]@7 KPI: Kernel MPM Clock frequency = 32768 [ 1.856624] (7)[1:swapper/0][ 1.856623]@7 KernelSU: ksu_lsm_hook_init [ 1.858376] (7)[1:swapper/0][ 1.858374]@7 KernelSU: sucompat: execve_kp: 0 [ 1.860056] (7)[1:swapper/0][ 1.860055]@7 KernelSU: sucompat: newfstatat_kp: 0 [ 1.861665] (7)[1:swapper/0][ 1.861664]@7 KernelSU: sucompat: faccessat_kp: 0 [ 1.863232] (7)[1:swapper/0][ 1.863232]@7 KernelSU: ksud: execve_kp: 0 [ 1.864843] (7)[1:swapper/0][ 1.864842]@7 KernelSU: ksud: vfs_read_kp: 0 [ 1.869331] (7)[1:swapper/0][ 1.869330]@7 KernelSU: ksud: input_handle_event_kp: 0 [ 1.990711] (6)[1:swapper/0][ 1.990710]@6 KernelSU: KEY_VOLUMEDOWN val: 0 [ 1.990715] (6)[1:swapper/0][ 1.990714]@6 KernelSU: KEY_VOLUMEDOWN val: 0 [ 2.187370] (0)[1:swapper/0][ 2.187367]@0 BOOTPROF: 2187.366203:Kernel_init_done [ 2.262290] (7)[1:init][ 2.262289]@7 KernelSU: /system/bin/init second_stage executed [ 2.262292] (7)[1:init][ 2.262292]@7 KernelSU: type su does not exist [ 2.262294] (7)[1:init][ 2.262293]@7 KernelSU: type su does not exist [ 2.262295] (7)[1:init][ 2.262295]@7 KernelSU: type su does not exist [ 2.262296] (7)[1:init][ 2.262296]@7 KernelSU: type su does not exist [ 2.262298] (7)[1:init][ 2.262298]@7 KernelSU: add_type: insert symtab failed. [ 2.262300] (7)[1:init][ 2.262299]@7 KernelSU: type ksu_file does not exist [ 2.262302] (7)[1:init][ 2.262301]@7 KernelSU: target type ksu_file does not exist [ 2.262303] (7)[1:init][ 2.262303]@7 KernelSU: source type su does not exist [ 2.262305] (7)[1:init][ 2.262304]@7 KernelSU: source type kernel does not exist [ 2.262306] (7)[1:init][ 2.262306]@7 KernelSU: source type kernel does not exist [ 2.262307] (7)[1:init][ 2.262307]@7 KernelSU: source type kernel does not exist [ 2.262309] (7)[1:init][ 2.262308]@7 KernelSU: source type kernel does not exist [ 2.262310] (7)[1:init][ 2.262310]@7 KernelSU: source type kernel does not exist [ 2.262312] (7)[1:init][ 2.262311]@7 KernelSU: source type kernel does not exist [ 2.262313] (7)[1:init][ 2.262312]@7 KernelSU: source type kernel does not exist [ 2.262314] (7)[1:init][ 2.262314]@7 KernelSU: source type kernel does not exist [ 2.262316] (7)[1:init][ 2.262315]@7 KernelSU: source type init does not exist [ 2.262317] (7)[1:init][ 2.262317]@7 KernelSU: source type init does not exist [ 2.262319] (7)[1:init][ 2.262318]@7 KernelSU: source type servicemanager does not exist [ 2.262320] (7)[1:init][ 2.262319]@7 KernelSU: source type servicemanager does not exist [ 2.262321] (7)[1:init][ 2.262321]@7 KernelSU: source type servicemanager does not exist [ 2.262323] (7)[1:init][ 2.262322]@7 KernelSU: source type servicemanager does not exist [ 2.262324] (7)[1:init][ 2.262323]@7 KernelSU: source type servicemanager does not exist [ 2.262325] (7)[1:init][ 2.262325]@7 KernelSU: target type su does not exist [ 2.262327] (7)[1:init][ 2.262326]@7 KernelSU: source type logd does not exist [ 2.262328] (7)[1:init][ 2.262328]@7 KernelSU: source type logd does not exist [ 2.262329] (7)[1:init][ 2.262329]@7 KernelSU: source type logd does not exist [ 2.262331] (7)[1:init][ 2.262330]@7 KernelSU: source type logd does not exist [ 2.262332] (7)[1:init][ 2.262331]@7 KernelSU: target type su does not exist [ 2.262333] (7)[1:init][ 2.262333]@7 KernelSU: target type su does not exist [ 2.262335] (7)[1:init][ 2.262334]@7 KernelSU: target type su does not exist [ 2.262336] (7)[1:init][ 2.262335]@7 KernelSU: target type su does not exist [ 2.262337] (7)[1:init][ 2.262337]@7 KernelSU: target type su does not exist [ 2.262339] (7)[1:init][ 2.262338]@7 KernelSU: source type hwservicemanager does not exist [ 2.262340] (7)[1:init][ 2.262340]@7 KernelSU: source type hwservicemanager does not exist [ 2.262342] (7)[1:init][ 2.262341]@7 KernelSU: source type hwservicemanager does not exist [ 2.262343] (7)[1:init][ 2.262343]@7 KernelSU: source type hwservicemanager does not exist [ 2.262344] (7)[1:init][ 2.262344]@7 KernelSU: target type su does not exist [ 2.262346] (7)[1:init][ 2.262345]@7 KernelSU: source type system_server does not exist [ 2.262347] (7)[1:init][ 2.262347]@7 KernelSU: source type system_server does not exist

tiann commented 1 year ago 
03-23 21:36:51.096 10378 10378 F libc    : Fatal signal 31 (SIGSYS), code 1 (SYS_SECCOMP) in tid 10378 (dmesg), pid 10378 (dmesg)
03-23 21:36:51.129 10381 10381 I crash_dump64: obtaining output fd from tombstoned, type: kDebuggerdTombstoneProto
03-23 21:36:51.131 10381 10381 I crash_dump64: performing dump of process 10378 (target tid = 10378)
03-23 21:36:51.147 10381 10381 F DEBUG   : Process name is dmesg, not key_process
03-23 21:36:51.147 10381 10381 F DEBUG   : keyProcess: 0
03-23 21:36:51.147 10381 10381 F DEBUG   : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
03-23 21:36:51.147 10381 10381 F DEBUG   : Build fingerprint: 'realme/RMX2202EEA/RMX2202L1:13/TP1A.220905.001/R.caf39b_a8c65_ddc5:user/release-keys'
03-23 21:36:51.147 10381 10381 F DEBUG   : Revision: '0'
03-23 21:36:51.147 10381 10381 F DEBUG   : ABI: 'arm64'
03-23 21:36:51.147 10381 10381 F DEBUG   : Timestamp: 2023-03-23 21:36:51.132419569+0800
03-23 21:36:51.147 10381 10381 F DEBUG   : Process uptime: 1s
03-23 21:36:51.147 10381 10381 F DEBUG   : Cmdline: dmesg
03-23 21:36:51.147 10381 10381 F DEBUG   : pid: 10378, tid: 10378, name: dmesg  >>> dmesg <<<
03-23 21:36:51.147 10381 10381 F DEBUG   : uid: 10246
03-23 21:36:51.147 10381 10381 F DEBUG   : signal 31 (SIGSYS), code 1 (SYS_SECCOMP), fault addr --------
03-23 21:36:51.147 10381 10381 F DEBUG   : Cause: seccomp prevented call to disallowed arm64 system call 116
03-23 21:36:51.147 10381 10381 F DEBUG   :     x0  000000000000000a  x1  0000000000000000  x2  0000000000000000  x3  0000000000000000
03-23 21:36:51.147 10381 10381 F DEBUG   :     x4  0000007fc06c9181  x5  0000000000000004  x6  0000803e0d070a4e  x7  2e6d686171ff372c
03-23 21:36:51.147 10381 10381 F DEBUG   :     x8  0000000000000074  x9  761f0ba03b9731ce  x10 0000007fc06c70e0  x11 0000007fc06c70b0
03-23 21:36:51.147 10381 10381 F DEBUG   :     x12 ffffff80ffffffd0  x13 0000000000000040  x14 0000000000000040  x15 0000000000000000
03-23 21:36:51.147 10381 10381 F DEBUG   :     x16 0000005946649940  x17 0000007287dbceb0  x18 000000728a7e0000  x19 0000000000000000
03-23 21:36:51.147 10381 10381 F DEBUG   :     x20 0000000000000000  x21 000000728962a000  x22 000000594664d418  x23 000000594664e468
03-23 21:36:51.147 10381 10381 F DEBUG   :     x24 000000594664ab00  x25 0000000000000000  x26 0000000000000000  x27 0000000000000000
03-23 21:36:51.147 10381 10381 F DEBUG   :     x28 0000000000000000  x29 0000007fc06c9190
03-23 21:36:51.147 10381 10381 F DEBUG   :     lr  00000059466266ec  sp  0000007fc06c7180  pc  0000007287dbcebc  pst 0000000060001000
03-23 21:36:51.147 10381 10381 F DEBUG   : backtrace:
03-23 21:36:51.147 10381 10381 F DEBUG   :       #00 pc 00000000000d1ebc  /apex/com.android.runtime/lib64/bionic/libc.so (klogctl+12) (BuildId: 59222d1015276d9a9031ee1ea28c0bcd)
03-23 21:36:51.147 10381 10381 F DEBUG   :       #01 pc 00000000000546e8  /system/bin/toybox (dmesg_main+444) (BuildId: 6a671ea83c76aee69768e6ef4977d04c)
03-23 21:36:51.147 10381 10381 F DEBUG   :       #02 pc 0000000000035884  /system/bin/toybox (toy_exec_which+96) (BuildId: 6a671ea83c76aee69768e6ef4977d04c)
03-23 21:36:51.147 10381 10381 F DEBUG   :       #03 pc 000000000003517c  /system/bin/toybox (toybox_main+136) (BuildId: 6a671ea83c76aee69768e6ef4977d04c)
03-23 21:36:51.147 10381 10381 F DEBUG   :       #04 pc 0000000000035904  /system/bin/toybox (main+120) (BuildId: 6a671ea83c76aee69768e6ef4977d04c)
03-23 21:36:51.147 10381 10381 F DEBUG   :       #05 pc 0000000000075c7c  /apex/com.android.runtime/lib64/bionic/libc.so (__libc_init+100) (BuildId: 59222d1015276d9a9031ee1ea28c0bcd)

你应该关掉 oppo 官方内核关于 root 的安全机制。

qiurigao commented 1 year ago

boot_21--1970-01-03-20-22-35.tar.gz


<6>  (2)[9687:libksud.so][20230324_22:09:17.491451]@2 KernelSU: option: 0xdeadbeef, cmd: 0
<6>  (2)[9687:libksud.so][20230324_22:09:17.491466]@2 KernelSU: allow root for: 10246
<6>  (2)[9687:libksud.so][20230324_22:09:17.491490]@2 KernelSU: error: 0, sid: 2140
<14>  (3)[685:logd.reader][20230324_22:09:17.626202]@3 logd: logdr: UID=10246 GID=10246 PID=9697 n tail=0 logMask=99 pid=0 start=0ns deadline=0ns
<14>  (2)[1:init][20230324_22:09:17.757880]@2 init: starting service 'oplus_kevents'...
<14>  (2)[1:init][20230324_22:09:17.788935]@2 init: Service 'oplus_kevents' (pid 9707) exited with status 255
<14>  (2)[1:init][20230324_22:09:17.788969]@2 init: Sending signal 9 to service 'oplus_kevents' (pid 9707) process group...
<14>  (2)[1:init][20230324_22:09:17.789189]@2 libprocessgroup: Successfully killed process cgroup uid 1000 pid 9707 in 0ms
<11>  (2)[1:init][20230324_22:09:17.789387]@2 init: process with updatable components 'oplus_kevents' exited 4 times in 4 minutes
<14>  (4)[1:init][20230324_22:09:17.800123]@4 init: processing action (sys.init.updatable_crashing=1) from (/system/etc/init/flags_health_check.rc:10)
<14>  (4)[1:init][20230324_22:09:17.800308]@4 init: starting service 'exec 62 (/system/bin/flags_health_check UPDATABLE_CRASHING)'...
<14>  (4)[1:init][20230324_22:09:17.801588]@4 init: SVC_EXEC service 'exec 62 (/system/bin/flags_health_check UPDATABLE_CRASHING)' pid 9710 (uid 1000 gid 1000+0 context default) started; waiting...
<14>  (4)[1:init][20230324_22:09:17.810478]@4 init: Service 'exec 62 (/system/bin/flags_health_check UPDATABLE_CRASHING)' (pid 9710) exited with status 0 waiting took 0.009000 seconds
<14>  (4)[1:init][20230324_22:09:17.810494]@4 init: Sending signal 9 to service 'exec 62 (/system/bin/flags_health_check UPDATABLE_CRASHING)' (pid 9710) process group...
<6>  (1)[6959:weishu.kernelsu][20230324_22:09:17.814123]@1 KernelSU: option: 0xdeadbeef, cmd: 2
<6>  (1)[6959:weishu.kernelsu][20230324_22:09:17.814159]@1 KernelSU: option: 0xdeadbeef, cmd: 9
<6>  (1)[6959:weishu.kernelsu][20230324_22:09:17.814165]@1 KernelSU: volumedown_pressed_count: 0
<6>  (6)[9711:libksud.so][20230324_22:09:17.821134]@6 KernelSU: option: 0xdeadbeef, cmd: 0
<6>  (6)[9711:libksud.so][20230324_22:09:17.821140]@6 KernelSU: allow root for: 10246
<6>  (6)[9711:libksud.so][20230324_22:09:17.821151]@6 KernelSU: error: 0, sid: 2140
<5>  (7)[1601:bcc_kthread][20230324_22:09:18.125349]@7 [OPLUS_CHG][oplus_chg_print_bcc_log]BCC[100 / 100 / 100 / 4246 / 110 / 203 / 4910 / 0]
<3>  (3)[228:kworker/3:1H][20230324_22:09:19.261350]@3 [OPLUS_CHG][get_soc_feature]get_soc_feature [soc_ajust_feature]:soc_ajust[0]
<3>  (3)[228:kworker/3:1H][20230324_22:09:19.261385]@3 [OPLUS_CHG][oplus_chg_get_battery_data]get_battery_data [soc_ajust_feature]:chip->soc[100]
<3>  (3)[228:kworker/3:1H][20230324_22:09:19.261406]@3 [OPLUS_CHG][oplus_check_afi_update_condition] true 3: normal charger or others unkown
<5>  (3)[228:kworker/3:1H][20230324_22:09:19.274654]@3 [OPLUS_CHG][oplus_chg_set_charging_current][BATTERY]LED ON, charging current: 1100
<3>  (3)[228:kworker/3:1H][20230324_22:09:19.275301]@3 [OPLUS_CHG][smbchg_set_fastchg_current_raw]set fcc to 1100 mA
<3>  (3)[228:kworker/3:1H][20230324_22:09:19.275995]@3 [OPLUS_CHG][get_soc_feature]get_soc_feature [soc_ajust_feature]:soc_ajust[0]
<5>  (3)[228:kworker/3:1H][20230324_22:09:19.276015]@3 [OPLUS_CHG][oplus_chg_update_ui_soc]ui_soc:100,waiting_for_ffc:0,fastchg_to_ffc:0,fastchg_start:0,chg_type=0x0
<5>  (3)[228:kworker/3:1H][20230324_22:09:19.276087]@3 [OPLUS_CHG][oplus_chg_print_log]CHGR[ 1 / 4 / 4912 / 1 / 0 ], BAT[ 1 / 0 / 1 / 0 / 1 / 40 ], GAUGE[ 204 / 204 / 4265 / 4265 / 86 / 500 / 100 / 100 / 100 / 2926 ], STATUS[ 0x0 / 0 / 0 / 0 / 0 / 0x0 / 0 ], OTHER[ 0 / 0 / 1 / 0 / 0 / 0 / 0 / -2740 / -2740 ], VOOCPHY[ 0 / 0 / 0 / 0 / 0 / 0x0]
<5>  (3)[1601:bcc_kthread][20230324_22:09:20.140953]@3 [OPLUS_CHG][oplus_chg_print_bcc_log]BCC[100 / 100 / 100 / 4265 / 86 / 204 / 4912 / 0]
<4>  (2)[3214:OplusNetworkSta][20230324_22:09:20.177427]@2 [oplus_score]: add uid, num = 1, index = 0, uid=10247
<4>  (0)[0:swapper/0][20230324_22:09:20.684695]@0 ALERT: changing window size from 16000000 to 8000000 at 47264050710
<4>  (2)[5467:Jit thread pool][20230324_22:09:20.748712]@2 ALERT: changing window size from 8000000 to 16000000 at 47328066126
<4>  (0)[3214:OplusNetworkSta][20230324_22:09:20.840792]@0 [oplus_score]: add uid, num = 2, index = 0, uid=10246
<4>  (0)[3214:OplusNetworkSta][20230324_22:09:20.840823]@0 [oplus_score]: add uid, num = 2, index = 1, uid=10247
<6>  (6)[620:kworker/6:3][20230324_22:09:21.198356]@6 KernelSU: renameat: packages.list.tmp -> packages.list, new path: /system/packages.list
<3>  (6)[620:kworker/6:3]KernelSU: do_update_uid, open /data/system/packages.list failed: -13