search

tiann / KernelSU

A Kernel based root solution for Android
https://kernelsu.org
GNU General Public License v3.0
9.75k stars 1.59k forks source link

ChromeOS arcvm中调用/system/bin/sh的应用无法正常使用root权限 #668

Closed natsumerinchan closed 1 year ago

natsumerinchan commented 1 year ago

阐述bug ChromeOS上部分应用授权后实际上无法使用root权限，adb shell无法获取root权限 复现步骤 1.在ChromeOS安装KernelSU https://www.reddit.com/r/chromeos/comments/14bwi9r/tutorial_root_your_chromeos_android_subsystem/

2.为应用授权，但发现部分应用授权后实际上没有root权限

预期行为 所有应用都能正常授权

截图

photo_2023-06-20_17-39-55

设备信息 :

日志

KernelSU_bugreport_2023-06-20_17_34.tar.gz

tiann commented 1 year ago

哪些包名是没有授权的？

tiann commented 1 year ago

sucompat: newfstatat_kp: -2

tiann commented 1 year ago

提供一下 kernel 的源码

natsumerinchan commented 1 year ago

提供一下 kernel 的源码

https://chromium.googlesource.com/chromiumos/third_party/kernel.git/+/refs/heads/chromeos-5.10-arcvm

natsumerinchan commented 1 year ago

哪些包名是没有授权的？

只授权了截图里的

tiann commented 1 year ago

我不知道你截图的应用对应的包名是什么

tiann commented 1 year ago

/cat /proc/kallsyms > /sdcard/sym.txt 然后把这个文件传上来

natsumerinchan commented 1 year ago

/cat /proc/kallsyms > /sdcard/sym.txt 然后把这个文件传上来

sym.txt

natsumerinchan commented 1 year ago

我不知道你截图的应用对应的包名是什么

me.zhanghai.android.files #有效
yarolegovich.materialterminal #无效
com.sanmer.mrepo #无效
com.yxer.packageinstalles #有效
com.android.shell #无效
tiann commented 1 year ago

等这个 CI 编译完后再试一下：https://github.com/tiann/KernelSU/commit/cd3e29248979fb41b6edc34395033726716c5cf5

natsumerinchan commented 1 year ago

等这个 CI 编译完后再试一下：cd3e292

更新后问题依旧

Manager(11023) + Kernel(11022)

KernelSU_bugreport_2023-06-20_19_33.tar.gz

tiann commented 1 year ago

日志中只看到一个 App 申请 su，你在更新 kernel 后，是否有对这些 App 进行操作？

natsumerinchan commented 1 year ago

日志中只看到一个 App 申请 su，你在更新 kernel 后，是否有对这些 App 进行操作？

有，我更新后删掉allowlist重新授权了

natsumerinchan commented 1 year ago 
[   30.621027] KernelSU: set root profile, key: me.zhanghai.android.files, uid: 10082, gid: 0, context: u:r:su:s0
[   30.621474] KernelSU: save allow list, name: $ uid :9999, allow: 0
[   30.621488] KernelSU: save allow list, name: me.zhanghai.android.files uid :10082, allow: 1
[   31.684674] init: Untracked pid 216 exited with status 137
[   32.831236] binder: undelivered transaction 91844, process died.
[   32.835406] binder: undelivered transaction 91845, process died.
[   38.252822] KernelSU: set root profile, key: yarolegovich.materialterminal, uid: 10072, gid: 0, context: u:r:su:s0
[   38.253176] KernelSU: save allow list, name: $ uid :9999, allow: 0
[   38.253186] KernelSU: save allow list, name: me.zhanghai.android.files uid :10082, allow: 1
[   38.253192] KernelSU: save allow list, name: yarolegovich.materialterminal uid :10072, allow: 1
[   40.409235] KernelSU: prctl reply error, cmd: 12
[   40.409255] KernelSU: prctl reply error, cmd: 13
[   40.421670] KernelSU: handle umount for uid: 10049
[   40.610209] init: Untracked pid 3415 received signal 9
[   41.276237] KernelSU: set root profile, key: com.sanmer.mrepo, uid: 10087, gid: 0, context: u:r:su:s0
[   41.276631] KernelSU: save allow list, name: $ uid :9999, allow: 0
[   41.276658] KernelSU: save allow list, name: me.zhanghai.android.files uid :10082, allow: 1
[   41.276665] KernelSU: save allow list, name: yarolegovich.materialterminal uid :10072, allow: 1
[   41.276671] KernelSU: save allow list, name: com.sanmer.mrepo uid :10087, allow: 1
[   45.348095] KernelSU: set root profile, key: com.yxer.packageinstalles, uid: 10085, gid: 0, context: u:r:su:s0
[   45.348604] KernelSU: save allow list, name: $ uid :9999, allow: 0
[   45.348617] KernelSU: save allow list, name: me.zhanghai.android.files uid :10082, allow: 1
[   45.348626] KernelSU: save allow list, name: yarolegovich.materialterminal uid :10072, allow: 1
[   45.348635] KernelSU: save allow list, name: com.sanmer.mrepo uid :10087, allow: 1
[   45.348663] KernelSU: save allow list, name: com.yxer.packageinstalles uid :10085, allow: 1
[   47.907893] KernelSU: set root profile, key: com.android.shell, uid: 2000, gid: 0, context: u:r:su:s0
[   47.908297] KernelSU: save allow list, name: $ uid :9999, allow: 0
[   47.908310] KernelSU: save allow list, name: me.zhanghai.android.files uid :10082, allow: 1
[   47.908319] KernelSU: save allow list, name: yarolegovich.materialterminal uid :10072, allow: 1
[   47.908327] KernelSU: save allow list, name: com.sanmer.mrepo uid :10087, allow: 1
[   47.908337] KernelSU: save allow list, name: com.yxer.packageinstalles uid :10085, allow: 1
[   47.908391] KernelSU: save allow list, name: com.android.shell uid :2000, allow: 1
tiann commented 1 year ago

授权以后有没有操作那些 App？

natsumerinchan commented 1 year ago

授权以后有没有操作那些 App？

试过在adb shell执行su，依旧提示su不存在

唯一一个能正常使用root权限的shell应用是Termux

KernelSU_bugreport_2023-06-21_11_49.tar.gz.gz

sym.txt

natsumerinchan commented 1 year ago

我不知道你截图的应用对应的包名是什么

me.zhanghai.android.files #有效
yarolegovich.materialterminal #无效
com.sanmer.mrepo #无效
com.yxer.packageinstalles #有效
com.android.shell #无效

追加

com.termux #有效
tiann commented 1 year ago

我加了一些日志，请在这个 CI 编译完后再试一下：https://github.com/tiann/KernelSU/actions/runs/5330045982/jobs/9656333047?pr=670

natsumerinchan commented 1 year ago

我加了一些日志，请在这个 CI 编译完后再试一下：https://github.com/tiann/KernelSU/actions/runs/5330045982/jobs/9656333047?pr=670

好的👌

natsumerinchan commented 1 year ago

KernelSU_bugreport_2023-06-21_12_54.tar.gz.gz

tiann commented 1 year ago

把 /data/adb/ksu/.allowlist 删掉重启，然后重新授权，打开无法授权的应用再发一下日志

natsumerinchan commented 1 year ago

把 /data/adb/ksu/.allowlist 删掉重启，然后重新授权，打开无法授权的应用再发一下日志

好的

KernelSU_bugreport_2023-06-21_13_05.tar.gz.gz

tiann commented 1 year ago

setenforce 0 后能使吗？

natsumerinchan commented 1 year ago

setenforce 0 后能使吗？

还是不能

tiann commented 1 year ago

从日志看，能否获取 root 似乎是个随即现象，同一个应用反复关闭打开，结果一致吗？

natsumerinchan commented 1 year ago

应该是一致的

KernelSU_bugreport_2023-06-21_13_47.tar.gz.gz

tiann commented 1 year ago

确定内核更新了？看不到更新后的日志

natsumerinchan commented 1 year ago

确定内核更新了？看不到更新后的日志

内核和管理器都是11023

tiann commented 1 year ago

用这个再试一下：https://github.com/tiann/KernelSU/actions/runs/5330757236/jobs/9657773305?pr=670

natsumerinchan commented 1 year ago

用这个再试一下：https://github.com/tiann/KernelSU/actions/runs/5330757236/jobs/9657773305?pr=670

还是无效，但我怀疑ci直接编译了main分支而不是arcvm分支，新更改压根没编进去

我在本地获取arcvm分支的commit数为825,而ci仍是823,我试试本地编译

[celica@arch workdir]$ git clone https://github.com/tiann/KernelSU.git -b arcvm
正克隆到 'KernelSU'...
remote: Enumerating objects: 18904, done.
remote: Counting objects: 100% (1915/1915), done.
remote: Compressing objects: 100% (585/585), done.
remote: Total 18904 (delta 1003), reused 1777 (delta 884), pack-reused 16989
接收对象中: 100% (18904/18904), 14.00 MiB | 1.64 MiB/s, 完成.
处理 delta 中: 100% (10483/10483), 完成.
[celica@arch workdir]$ cd KernelSU/
[celica@arch KernelSU]$ git branch
* arcvm
[celica@arch KernelSU]$ git rev-list --count HEAD
825
[celica@arch KernelSU]$

编好了 bzImage.zip

natsumerinchan commented 1 year ago

现在应该有新日志了

KernelSU_bugreport_2023-06-21_16_05.tar.gz.gz

tiann commented 1 year ago

从日志看，mrepo 获取 su 成功了？

natsumerinchan commented 1 year ago

从日志看，mrepo 获取 su 成功了？

但实际上没有权限 Screenshot 2023-06-21 18 52 07

这是11027的log

KernelSU_bugreport_2023-06-21_18_51.tar.gz.gz

tiann commented 1 year ago

更新到这个 commit：https://github.com/tiann/KernelSU/commit/27be1fa77091873bd283f6ac0f4035bfe89c6383 再试下

natsumerinchan commented 1 year ago

更新后在swift backup截到的图(其它应用依旧)

授权： Screenshot 2023-06-21 20 35 09

未授权： Screenshot 2023-06-21 20 35 34

KernelSU_bugreport_2023-06-21_20_35.tar.gz.gz

swift backup log SwiftLogger Logs.txt

tiann commented 1 year ago

关掉所有模块后还有这个现象吗？

natsumerinchan commented 1 year ago

关掉所有模块后还有这个现象吗？

依旧有

tiann commented 1 year ago

这些有的能授权，有的不能授权的应用，带有 arm 原生库的有多少？这方面有什么共性吗，因为你的设备是 x86_64 的，如果用 arm 的原生库，可能涉及到转译？内核会直接操作寄存器，可能有问题

natsumerinchan commented 1 year ago

这些有的能授权，有的不能授权的应用，带有 arm 原生库的有多少？这方面有什么共性吗，因为你的设备是 x86_64 的，如果用 arm 的原生库，可能涉及到转译？内核会直接操作寄存器，可能有问题

Material Terminal(yarolegovich.materialterminal) x86 #无效

MRepo(com.sanmer.mrepo) 无原生库 #无效

R-安装组件(com.yxer.packageinstalles) arm64 #有效

Swift Backup(org.swiftapps.swiftbackup) x86_64 #知道自己有root但获取KernelSU版本失败

Termux(com.termux) x86_64 #有效

shell(com.android.shell) 无原生库 #无效

质感文件(me.zhanghai.android.files) x86_64 #有效
natsumerinchan commented 1 year ago 
:/ $ busybox sh
/ $ su
sh: su: not found
/ $ /system/bin/su
:/ # id
uid=0(root) gid=0(root) groups=0(root) context=u:r:su:s0
:/ #

我在Material Terminal打开busybox内置的sh再执行/system/bin/su就成功获得root权限了，可能是arcvm的/system/bin/sh有问题

tiann commented 1 year ago

在 adb shell 执行 /system/bin/su 可以吗？

natsumerinchan commented 1 year ago

套层busybox shell就行

Screenshot 2023-06-21 22 12 52

natsumerinchan commented 1 year ago

termux能用root是因为它用的是自带的sh Screenshot 2023-06-21 21 57 01

natsumerinchan commented 1 year ago

能正常用root权限的基本都自带sh或busybox

Screenshot 2023-06-21 22 46 10 Screenshot 2023-06-21 22 46 45

natsumerinchan commented 1 year ago

获得root权限后也无法正常执行su命令

Screenshot 2023-06-21 22 53 31

tiann commented 1 year ago

su -V, su -h 这种能执行吗？

natsumerinchan commented 1 year ago

su -V, su -h 这种能执行吗？

只能在busybox shell用完整路径执行，进入root后反而用不了

Screenshot 2023-06-21 23 07 13

tiann commented 1 year ago

不在 busybox 中能执行 su -h, su -V 吗？

natsumerinchan commented 1 year ago

不在 busybox 中能执行 su -h, su -V 吗？

不能

crosh> shell
chronos@localhost / $ sudo bash
localhost / # adb shell
volteer_cheets:/ $ /system/bin/su
/system/bin/sh: /system/bin/su: inaccessible or not found
127|volteer_cheets:/ $ /system/bin/su -v                
/system/bin/sh: /system/bin/su: inaccessible or not found
127|volteer_cheets:/ $ su -v
/system/bin/sh: su: inaccessible or not found
127|volteer_cheets:/ $
tiann commented 1 year ago

试试手动集成源码的方式还有这个问题吗？