[Q] builds available somewhere?

[jeekajoo]

Hello,

It looks like Koush's superuser (https://github.com/koush/Superuser) is discontinued.
Last update was february 2014 - date of the files provided in the last archive posted here http://koush.com/post/superuser.
Unfortunately It is not compatible with lollipop: koush/Superuser#268

Do you have builds (compiled, recovery flashable zips) of your superuser fork somewhere?
I think there is a need to have this opensource alternative available for everyone.

Thanks much

[mid-kid]

Nevermind, I haven't been able to enter su with ADB. If I ever get it working, I'll upload again.
If anyone wants to test it, go ahead.

Original comment:
Since this isn't going anywhere, I've built it myself (the lp5.1 branch).
Using NDK r10d, and the platforms required by each of the projects (Superuser API-19 and Widgets API-17), I've had to make some changes related to the strings, but otherwise it builds correctly.
Downloads are here, named superuser--.zip, and I've included a .diff file for the changes I've made.
I won't be maintaining this, just building whenever there's an update, and I notice it.

[jeekajoo]

FYI someone patched SElinux for superuser to work on LP:
koush/Superuser#270
I asked him if it's something do-able to fork superuser and integrate its fix (https://github.com/xmikos/setools-android/) in it...
No reply.

[mid-kid]

Well, copying /system/etc/install-recovery.sh to /system/etc/init.d/10superuser worked, and I've been able to give ADB root access, and enter with su. I just have no idea how secure that solution may be (I have no idea how selinux works), and if it works with other apps. I'll test further, and if it works, I'll make the updater .zip install that file correctly.

[jeekajoo]

did you have to disable selinux for this to work?

[mid-kid]

@jeekajoo I didn't even touch it. Under About phone, SELinux is "permissive" (Don't know what that means). I'm using this rom, which states SELinux as "fixed" in the known issues post.
I've uploaded a _2 release which installs the init.d script if you have support for it, otherwise it warns you about it. It installs /etc/install-recovery.sh anyway, since I don't think it'll cause any conflicts, but if someone experiences any problems, please report.
Fun fact: SuperSU also installs it's daemon in init.d, and still installs install-recovery.sh next to it. So I guess it's fine.

[jeekajoo]

permissive means it just logs. recommendation is full 'enforcing' since LP.

In the Android 5.0 (L) release, Android moves to full enforcement of SELinux. This builds upon the permissive release of 4.3 and the partial enforcement of 4.4. In short, Android is shifting from enforcement on a limited set of crucial domains (installd, netd, vold and zygote) to everything (more than 60 domains). This means manufacturers will have to better understand and scale their SELinux implementations to provide compatible devices. Understand that:

Everything is in enforcing mode in the 5.0 release

https://source.android.com/devices/tech/security/selinux/index.html

I'll be using omnirom too, but on nexus5.
They managed to get 'enforcing' working on 5.1.1 (https://plus.google.com/u/0/+YassineCHERIFF/posts/WhMVx7nRzU3) so I'll have to make sure your superuser can work with it.

[mid-kid]

Didn't this commit in this repo fix it? It looks like some sort of init script, yet I don't know what init system it's for nor how to use it.
EDIT: Ah, it's one of the .rc files that belongs in the kernel's rootfs.
Otherwise, we can do the selinux policy stuff with that setools-android you linked, but I have no idea how that works.

[mid-kid]

Okay, I've been able to patch sepolicy with sepolicy-inject, but it sucks very much.
I've checked adb, and created a script to "convert" the "access denied" lines in logcat to sepolicy-inject, and added that to the init script. I've ended up with this monster:

# sepolicy-inject itself
sepolicy-inject -s "sysinit" -t "kernel" -c "security" -p "read_policy" -l
sepolicy-inject -s "sysinit" -t "selinuxfs" -c "file" -p "write" -l
sepolicy-inject -s "sysinit" -t "kernel" -c "security" -p "load_policy" -l

# setenforce
sepolicy-inject -s "sysinit" -t "kernel" -c "security" -p "setenforce" -l

# su daemon
sepolicy-inject -s "sysinit" -t "device" -c "dir" -p "write" -l
sepolicy-inject -s "sysinit" -t "device" -c "dir" -p "add_name" -l
sepolicy-inject -s "sysinit" -t "device" -c "dir" -p "create" -l
sepolicy-inject -s "sysinit" -t "device" -c "sock_file" -p "create" -l
sepolicy-inject -s "sysinit" -t "device" -c "dir" -p "setattr" -l
sepolicy-inject -s "sysinit" -t "device" -c "sock_file" -p "setattr" -l

# su from adb
sepolicy-inject -s "shell" -t "device" -c "sock_file" -p "write" -l
sepolicy-inject -s "shell" -t "sysinit" -c "unix_stream_socket" -p "connectto" -l
sepolicy-inject -s "sysinit" -t "shell" -c "dir" -p "search" -l
sepolicy-inject -s "sysinit" -t "shell" -c "file" -p "read" -l
sepolicy-inject -s "sysinit" -t "shell" -c "file" -p "open" -l
sepolicy-inject -s "sysinit" -t "shell" -c "lnk_file" -p "read" -l
sepolicy-inject -s "sysinit" -t "sysinit" -c "capability" -p "sys_ptrace" -l
sepolicy-inject -s "sysinit" -t "app_data_file" -c "dir" -p "search" -l
sepolicy-inject -s "sysinit" -t "app_data_file" -c "dir" -p "getattr" -l
sepolicy-inject -s "sysinit" -t "sysinit" -c "capability" -p "setuid" -l
sepolicy-inject -s "sysinit" -t "sysinit" -c "capability" -p "setgid" -l
sepolicy-inject -s "sysinit" -t "zygote_exec" -c "file" -p "execute" -l
sepolicy-inject -s "sysinit" -t "zygote_exec" -c "file" -p "read" -l
sepolicy-inject -s "sysinit" -t "zygote_exec" -c "file" -p "open" -l
sepolicy-inject -s "sysinit" -t "zygote_exec" -c "file" -p "execute_no_trans" -l
sepolicy-inject -s "sysinit" -t "dalvikcache_data_file" -c "file" -p "write" -l
sepolicy-inject -s "sysinit" -t "dalvikcache_data_file" -c "file" -p "execute" -l
sepolicy-inject -s "sysinit" -t "servicemanager" -c "binder" -p "call" -l
sepolicy-inject -s "servicemanager" -t "sysinit" -c "dir" -p "search" -l
sepolicy-inject -s "servicemanager" -t "sysinit" -c "file" -p "read" -l
sepolicy-inject -s "servicemanager" -t "sysinit" -c "file" -p "open" -l
sepolicy-inject -s "servicemanager" -t "sysinit" -c "process" -p "getattr" -l
sepolicy-inject -s "sysinit" -t "system_server" -c "binder" -p "call" -l
sepolicy-inject -s "sysinit" -t "system_server" -c "binder" -p "transfer" -l
sepolicy-inject -s "system_server" -t "sysinit" -c "binder" -p "call" -l
sepolicy-inject -s "sysinit" -t "datadata_file" -c "dir" -p "search" -l

Yes, this kinda works, but you need selinux disabled at boot, because otherwise you won't even be able to run sepolicy-inject. :P
And even if you enter in su with selinux enabled, you have the same permissions as any user (you can't view /data, for example).

I've tried looking into how SuperSU does things, but it's way too obfuscated to make that worthwhile. It does something inside the su binary that overrides all this stuff, not even using supolicy.

Other than this, I have absolutely no experience in SELinux, and I have no idea how to make this work.

[jeekajoo]

Kudos for that!
Didn't have time to test, sorry.
I cannot help you to make this cleaner but we might give a try to ask on xda forums or android.stackexchange.

[HeathenMan]

did u checked out / include changes made for powershell ? its a reworked koush su and works well (mostly ;))

@mid-kid
Can you share your instructions to build the superuser zip, I've been using but I want to build my own. Selinux doesn't matter, I have a rom that sets it as permissive.

[mid-kid]

@xfausto It's explained in the readme.md.

@mid-kid Have you planned to update or release another version?

[mid-kid]

@xfausto No. I have no idea kow to circumvent selinux like SuperSU does.

[jeekajoo]

adding @phhusson that is working on a fork too https://github.com/phhusson/Superuser