Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ChromeOS arcvm中调用/system/bin/sh的应用无法正常使用root权限 #668

Closed
natsumerinchan opened this issue Jun 20, 2023 · 92 comments

Comments

@natsumerinchan
Copy link
Contributor

natsumerinchan commented Jun 20, 2023

阐述bug
ChromeOS上部分应用授权后实际上无法使用root权限,adb shell无法获取root权限
复现步骤
1.在ChromeOS安装KernelSU https://www.reddit.com/r/chromeos/comments/14bwi9r/tutorial_root_your_chromeos_android_subsystem/

2.为应用授权,但发现部分应用授权后实际上没有root权限

预期行为
所有应用都能正常授权

截图

photo_2023-06-20_17-39-55

设备信息 :

日志

KernelSU_bugreport_2023-06-20_17_34.tar.gz

@natsumerinchan natsumerinchan changed the title Chrome式 Chrome部分应用授权无效 Jun 20, 2023
@natsumerinchan natsumerinchan closed this as not planned Won't fix, can't repro, duplicate, stale Jun 20, 2023
@natsumerinchan natsumerinchan changed the title Chrome部分应用授权无效 Chrome部分应用Root授权无效 Jun 20, 2023
@natsumerinchan natsumerinchan changed the title Chrome部分应用Root授权无效 ChromeOS部分应用Root授权无效 Jun 20, 2023
@tiann
Copy link
Owner

tiann commented Jun 20, 2023

哪些包名是没有授权的?

@tiann
Copy link
Owner

tiann commented Jun 20, 2023

sucompat: newfstatat_kp: -2

@tiann
Copy link
Owner

tiann commented Jun 20, 2023

提供一下 kernel 的源码

@natsumerinchan
Copy link
Contributor Author

@natsumerinchan
Copy link
Contributor Author

哪些包名是没有授权的?

只授权了截图里的

@tiann
Copy link
Owner

tiann commented Jun 20, 2023

我不知道你截图的应用对应的包名是什么

@tiann
Copy link
Owner

tiann commented Jun 20, 2023

/cat /proc/kallsyms > /sdcard/sym.txt 然后把这个文件传上来

@natsumerinchan
Copy link
Contributor Author

/cat /proc/kallsyms > /sdcard/sym.txt 然后把这个文件传上来

sym.txt

@natsumerinchan
Copy link
Contributor Author

natsumerinchan commented Jun 20, 2023

我不知道你截图的应用对应的包名是什么

me.zhanghai.android.files #有效
yarolegovich.materialterminal #无效
com.sanmer.mrepo #无效
com.yxer.packageinstalles #有效
com.android.shell #无效

@tiann
Copy link
Owner

tiann commented Jun 20, 2023

等这个 CI 编译完后再试一下:cd3e292

@natsumerinchan
Copy link
Contributor Author

等这个 CI 编译完后再试一下:cd3e292

更新后问题依旧

Manager(11023) + Kernel(11022)

KernelSU_bugreport_2023-06-20_19_33.tar.gz

@tiann
Copy link
Owner

tiann commented Jun 20, 2023

日志中只看到一个 App 申请 su,你在更新 kernel 后,是否有对这些 App 进行操作?

@natsumerinchan
Copy link
Contributor Author

日志中只看到一个 App 申请 su,你在更新 kernel 后,是否有对这些 App 进行操作?

有,我更新后删掉allowlist重新授权了

@natsumerinchan
Copy link
Contributor Author

[   30.621027] KernelSU: set root profile, key: me.zhanghai.android.files, uid: 10082, gid: 0, context: u:r:su:s0
[   30.621474] KernelSU: save allow list, name: $ uid :9999, allow: 0
[   30.621488] KernelSU: save allow list, name: me.zhanghai.android.files uid :10082, allow: 1
[   31.684674] init: Untracked pid 216 exited with status 137
[   32.831236] binder: undelivered transaction 91844, process died.
[   32.835406] binder: undelivered transaction 91845, process died.
[   38.252822] KernelSU: set root profile, key: yarolegovich.materialterminal, uid: 10072, gid: 0, context: u:r:su:s0
[   38.253176] KernelSU: save allow list, name: $ uid :9999, allow: 0
[   38.253186] KernelSU: save allow list, name: me.zhanghai.android.files uid :10082, allow: 1
[   38.253192] KernelSU: save allow list, name: yarolegovich.materialterminal uid :10072, allow: 1
[   40.409235] KernelSU: prctl reply error, cmd: 12
[   40.409255] KernelSU: prctl reply error, cmd: 13
[   40.421670] KernelSU: handle umount for uid: 10049
[   40.610209] init: Untracked pid 3415 received signal 9
[   41.276237] KernelSU: set root profile, key: com.sanmer.mrepo, uid: 10087, gid: 0, context: u:r:su:s0
[   41.276631] KernelSU: save allow list, name: $ uid :9999, allow: 0
[   41.276658] KernelSU: save allow list, name: me.zhanghai.android.files uid :10082, allow: 1
[   41.276665] KernelSU: save allow list, name: yarolegovich.materialterminal uid :10072, allow: 1
[   41.276671] KernelSU: save allow list, name: com.sanmer.mrepo uid :10087, allow: 1
[   45.348095] KernelSU: set root profile, key: com.yxer.packageinstalles, uid: 10085, gid: 0, context: u:r:su:s0
[   45.348604] KernelSU: save allow list, name: $ uid :9999, allow: 0
[   45.348617] KernelSU: save allow list, name: me.zhanghai.android.files uid :10082, allow: 1
[   45.348626] KernelSU: save allow list, name: yarolegovich.materialterminal uid :10072, allow: 1
[   45.348635] KernelSU: save allow list, name: com.sanmer.mrepo uid :10087, allow: 1
[   45.348663] KernelSU: save allow list, name: com.yxer.packageinstalles uid :10085, allow: 1
[   47.907893] KernelSU: set root profile, key: com.android.shell, uid: 2000, gid: 0, context: u:r:su:s0
[   47.908297] KernelSU: save allow list, name: $ uid :9999, allow: 0
[   47.908310] KernelSU: save allow list, name: me.zhanghai.android.files uid :10082, allow: 1
[   47.908319] KernelSU: save allow list, name: yarolegovich.materialterminal uid :10072, allow: 1
[   47.908327] KernelSU: save allow list, name: com.sanmer.mrepo uid :10087, allow: 1
[   47.908337] KernelSU: save allow list, name: com.yxer.packageinstalles uid :10085, allow: 1
[   47.908391] KernelSU: save allow list, name: com.android.shell uid :2000, allow: 1

@tiann
Copy link
Owner

tiann commented Jun 20, 2023

授权以后有没有操作那些 App?

@natsumerinchan
Copy link
Contributor Author

授权以后有没有操作那些 App?

试过在adb shell执行su,依旧提示su不存在

唯一一个能正常使用root权限的shell应用是Termux

KernelSU_bugreport_2023-06-21_11_49.tar.gz.gz

sym.txt

@natsumerinchan
Copy link
Contributor Author

我不知道你截图的应用对应的包名是什么

me.zhanghai.android.files #有效
yarolegovich.materialterminal #无效
com.sanmer.mrepo #无效
com.yxer.packageinstalles #有效
com.android.shell #无效

追加

com.termux #有效

@tiann
Copy link
Owner

tiann commented Jun 21, 2023

我加了一些日志,请在这个 CI 编译完后再试一下:https://github.com/tiann/KernelSU/actions/runs/5330045982/jobs/9656333047?pr=670

@natsumerinchan
Copy link
Contributor Author

我加了一些日志,请在这个 CI 编译完后再试一下:https://github.com/tiann/KernelSU/actions/runs/5330045982/jobs/9656333047?pr=670

好的👌

@natsumerinchan
Copy link
Contributor Author

@tiann
Copy link
Owner

tiann commented Jun 21, 2023

/data/adb/ksu/.allowlist 删掉重启,然后重新授权,打开无法授权的应用再发一下日志

@natsumerinchan
Copy link
Contributor Author

/data/adb/ksu/.allowlist 删掉重启,然后重新授权,打开无法授权的应用再发一下日志

好的

KernelSU_bugreport_2023-06-21_13_05.tar.gz.gz

@tiann
Copy link
Owner

tiann commented Jun 21, 2023

setenforce 0 后能使吗?

@natsumerinchan
Copy link
Contributor Author

setenforce 0 后能使吗?

还是不能

@tiann
Copy link
Owner

tiann commented Jun 21, 2023

从日志看,能否获取 root 似乎是个随即现象,同一个应用反复关闭打开,结果一致吗?

@1457384613gh
Copy link

对了@supechicken
你再输命令,看看,brunch 的内核支不支持 lvm 文件系统?

我之前尝试 lvm 的时候,成功 加载lvm 分区里的 kernel 和 initramfs.img 了。但是,提示 tty 错误,感觉,kernel 没能 加载好 lvm 文件系统的模块。

就算可以加载好,也要 修改 initramfs.img 提前把 lvm 挂载成块设备,然后去映射分区。

@1457384613gh
Copy link

1457384613gh commented Aug 27, 2023

我大改了一下【引导加载程序】,建议你们更新。

  • 使用了,grub2 文件管理器的代码,图形界面选择 【.img】和【.img.grub.txt】,以便支持任意分区 和 任意文件名;
  • 多语言;
  • 鼠标,触控板;
  • 图形界面设置倒计时时间;

Releases

https://github.com/M-L-P/grub2-brunch/releases

预览

简体中文
繁體中文

@tiann
@natsumerinchan
@supechicken

@1457384613gh
Copy link

1457384613gh commented Aug 30, 2023

@tiann @supechicken
有个 5.4 的 x86_64 的内核,编译成功后,使用,会自动重启,也类似于 卡 logo。
可不可以帮忙看下工作台的配置文件。
5.4 的内核需要什么特殊的步骤吗?
抽空帮忙看下配置文件写得对不对,有没有什么问题,谢谢

name: Build Kernel - FydeOS
on:
  push:
    branches: ["main"]
    paths:
      - ".github/workflows/build-kernel-fydeos.yml"
      - "kernel/**"
  pull_request:
    branches: ["main"]
    paths:
      - ".github/workflows/build-kernel-fydeos.yml"
      - "kernel/**"
  workflow_call:
  workflow_dispatch:

jobs:
  build:
    strategy:
      matrix:
        arch: [x86_64]
        version: ["5.4.241"]
        include:
          - arch: x86_64
            git_tag: chromeos-5.4
            file_name: "bzImage"

    name: Build FydeOS kernel
    runs-on: ubuntu-20.04
    env:
      LTO: thin
      ROOT_DIR: /
      KERNEL_DIR: ${{ github.workspace }}/kernel

    steps:
      - name: Install Build Tools
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends bc \
              bison build-essential ca-certificates flex git gnupg \
              libelf-dev libssl-dev lsb-release software-properties-common wget \
              libncurses-dev binutils-aarch64-linux-gnu gcc-aarch64-linux-gnu nuget gzip \
              rsync python3 device-tree-compiler
          sudo ln -s --force python3 /usr/bin/python
          export LLVM_VERSION=12
          wget https://apt.llvm.org/llvm.sh
          chmod +x llvm.sh
          sudo ./llvm.sh $LLVM_VERSION
          rm ./llvm.sh
          sudo ln -s --force /usr/bin/clang-$LLVM_VERSION /usr/bin/clang
          sudo ln -s --force /usr/bin/ld.lld-$LLVM_VERSION /usr/bin/ld.lld
          sudo ln -s --force /usr/bin/llvm-objdump-$LLVM_VERSION /usr/bin/llvm-objdump
          sudo ln -s --force /usr/bin/llvm-ar-$LLVM_VERSION /usr/bin/llvm-ar
          sudo ln -s --force /usr/bin/llvm-nm-$LLVM_VERSION /usr/bin/llvm-nm
          sudo ln -s --force /usr/bin/llvm-strip-$LLVM_VERSION /usr/bin/llvm-strip
          sudo ln -s --force /usr/bin/llvm-objcopy-$LLVM_VERSION /usr/bin/llvm-objcopy
          sudo ln -s --force /usr/bin/llvm-readelf-$LLVM_VERSION /usr/bin/llvm-readelf
          sudo ln -s --force /usr/bin/clang++-$LLVM_VERSION /usr/bin/clang++
      - name: Checkout KernelSU
        uses: actions/checkout@v3
        with:
          path: KernelSU
          ref: main
          fetch-depth: 0

      - name: Setup kernel source
        run: |
          git clone https://chromium.googlesource.com/chromiumos/third_party/kernel -b ${{ matrix.git_tag }}
          cd kernel
          git reset --hard 32ff4824772986b3969387ba85a00b82f506ede8
      - name: Apply FydeOS patches
        working-directory: kernel
        run: |
          git clone -b main https://github.com/openFyde/project-openfyde-patches.git
          cp ./project-openfyde-patches/sys-kernel/chromeos-kernel-5_4/files/*.patch ./
          ls -l | grep patch
          git apply ./031-hid-sensor-cros-compat.patch
          git apply ./034-silid-touchscreen-dmi.patch
          git apply ./035-add-iwlwifi-new-firmware-support.patch
          git apply ./036-fix-nl80211-for-wpa.patch
          git apply ./bluetooth.patch
          git apply ./intel_old_graphic.patch
          git apply ./mxc6655.patch
          git apply ./overlayfs.patch
          git apply ./weibu_panel_orientation.patch
          git apply ./wireless.patch
          git apply ./x86.patch
      - name: Setup KernelSU
        working-directory: kernel
        run: |
          echo "[+] KernelSU setup"
          KERNEL_ROOT=$GITHUB_WORKSPACE/kernel
          echo "[+] KERNEL_ROOT: $KERNEL_ROOT"
          echo "[+] Copy KernelSU driver to $KERNEL_ROOT/drivers"
          ln -sf $GITHUB_WORKSPACE/KernelSU/kernel $KERNEL_ROOT/drivers/kernelsu
          echo "[+] Add KernelSU driver to Makefile"
          DRIVER_MAKEFILE=$KERNEL_ROOT/drivers/Makefile
          grep -q "kernelsu" $DRIVER_MAKEFILE || echo "obj-y += kernelsu/" >> $DRIVER_MAKEFILE
          echo "[+] Patch script/setlocalversion"
          sed -i 's/-dirty//g' $KERNEL_ROOT/scripts/setlocalversion
          echo "[+] KernelSU setup done."
          cd $GITHUB_WORKSPACE/KernelSU
          VERSION=$(($(git rev-list --count HEAD) + 10200))
          echo "VERSION: $VERSION"
          echo "kernelsu_version=$VERSION" >> $GITHUB_ENV
        
      - name: Build Kernel
        working-directory: kernel
        run: |
          export DEFCONFIG=x86_64_defconfig
          make LLVM=1 LLVM_IAS=1 DEPMOD=depmod DTC=dtc O=${PWD} mrproper
          make LLVM=1 LLVM_IAS=1 DEPMOD=depmod DTC=dtc O=${PWD} ${DEFCONFIG} < /dev/null
          scripts/config --file .config -e LTO_CLANG -d LTO_NONE -e LTO_CLANG_THIN -d LTO_CLANG_FULL -e THINLTO
          make LLVM=1 LLVM_IAS=1 DEPMOD=depmod DTC=dtc O=${PWD} -j$(nproc) bzImage modules prepare-objtool
          echo "file_path=${PWD}/arch/x86/boot/bzImage" >> $GITHUB_ENV
      - name: Upload kernel-FydeOS-${{ matrix.arch }}-${{ matrix.version }}
        uses: actions/upload-artifact@v3
        with:
          name: kernel-FydeOS-${{ matrix.arch }}-${{ matrix.version }}
          path: "${{ env.file_path }}"

      - name: Post to Telegram
        if: ${{ ( github.event_name == 'push' && github.ref == 'refs/heads/main' ) || github.ref_type == 'tag' }}
        env:
          CHAT_ID: ${{ secrets.CHAT_ID }}
          CACHE_CHAT_ID: ${{ secrets.CACHE_CHAT_ID }}
          BOT_TOKEN: ${{ secrets.BOT_TOKEN }}
          MESSAGE_THREAD_ID: ${{ secrets.MESSAGE_THREAD_ID }}
          COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
          COMMIT_URL: ${{ github.event.head_commit.url }}
          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
        run: |
          TITLE=kernel-FydeOS-${{ matrix.arch }}-${{ matrix.version }}
          echo "[+] title: $TITLE"
          export TITLE
          export VERSION="${{ env.kernelsu_version }}"
          echo "[+] Compress images"
          gzip -n -f -9 "${{ env.file_path }}"
          echo "[+] Image to upload"
          ls -l "${{ env.file_path }}.gz"
          if [ -n "${{ secrets.BOT_TOKEN }}" ]; then
            pip3 install python-telegram-bot
            python3 "$GITHUB_WORKSPACE/KernelSU/scripts/ksubot.py" "${{ env.file_path }}.gz"
          fi

@supechicken
Copy link
Contributor

supechicken commented Sep 4, 2023

@1457384613gh 不要用defconfig, 那是 Linux mainline 的預設最小化配置(很多驅動都沒有啟用,開不了機很正常)

試試看用chromeos/config/chromeos/x86_64裡面的 config(裡面有幾個config, 看心情隨便選一個), 那些才是 ChromeOS 用的。

簡單點來說就是跳過make defconfig, chromeos/config/chromeos/x86_64/chromiumos-x86_64.flavour.config 拷到源碼主目錄的 .config 就行了。

EDIT

請用 ./scripts/kconfig/merge_config.shchromiumos-x86_64.flavour.configcommon.config 進行合併,然後把合併後的 config 拷到源碼主目錄的 .config

@1457384613gh
Copy link

大佬,你好懂。
我是小白,要废好些工夫理解。
我试试看,多谢指正。

@1457384613gh
Copy link

1457384613gh commented Sep 4, 2023

人家只找到了这一个你提及的文件,没看到 chromiumos-x86_64.flavour.config 和 common.config

https://chromium.googlesource.com/chromiumos/third_party/kernel/+/32ff4824772986b3969387ba85a00b82f506ede8/scripts/kconfig/merge_config.sh

本来,人家打算参考 brunch 框架 actions 编译内核的 代码。结果是 引用仓库里的一个 .sh 脚本。

然后,我进入脚本,想看看编译用到的命令,结果,好多内容杂糅在一起,还没有注释,感觉就要胡子眉毛一把抓,看天书一样。

😭😭😭看哭了,55555……对于人家没学过的来说,太超纲了。

@supechicken
Copy link
Contributor

等我一下,我幫你整理一下

@1457384613gh
Copy link

1457384613gh commented Sep 4, 2023

- name: Build Kernel
 working-directory: kernel 
 run: |  

🥺🥺🥺大佬,你可不可以帮我写这个部分?
你写好以后,我复制粘贴,拿机子测试。

要自己写的话,先把知识的漏环学一遍,再写,估计得两三年,太漫长了。
人家也没闲着,人家拿机子测试。人家,还试着改编 initramfs.img,看能不能 把 rootfs 挂载到 lvm 的逻辑卷里面。

编译好了以后,我会在 credit 那里提及你们的。

@1457384613gh
Copy link

1457384613gh commented Sep 4, 2023

等我一下,我幫你整理一下

闻道有先后,术业有专攻。
多谢大侠拨冗助攻,他日若有力所能及之处,在下定当略尽绵力。

@supechicken
Copy link
Contributor

supechicken commented Sep 4, 2023

大佬,你可不可以帮我写这个部分?

自己寫吧,其實理解了的話真的很簡單,編譯真正的 Android 手機內核才叫噁心

以下都是基於 chromeos-5.4 分支中的位置


1. 生成 config

合併以下文件以獲得一個完整的 kernel config

  • chromeos/config/chromeos/x86_64/chromiumos-x86_64.flavour.config (x86 ChromiumOS 專用)
  • chromeos/config/chromeos/x86_64/common.config (x86 專用)
  • chromeos/config/chromeos/base.config (通用)
# 合併, 記得把 chromeos/config/... 改掉
./scripts/kconfig/merge_config.sh -m chromeos/config/... chromeos/config/... chromeos/config/...
# 此時 .config 應該出現在源碼根目錄上面了

Brunch 大致上也是這麼做的,不過在此之上關了模塊壓縮還有除錯支持

https://github.com/sebanc/brunch/blob/abb5566b696e83ba0d1ec490ff2743bd93dd25d1/prepare_kernels.sh#L34-L38

2. 打補丁

就按你上面的 CI workflow 那樣做就好了 (Apply FydeOS patches + Setup KernelSU)

3. 關掉警告自動報錯

不然編譯器可能會因為一些小事報錯

make menuconfig # 進 config ui
# 進 general setup > 關掉 Compile the kernel with warnings as errors
# 儲存推出

4. 開始構建

這裡沒什麼好說的,報錯的話看看是不是裝漏了什麼包

make -j$(nproc) bzImage modules

@supechicken
Copy link
Contributor

@1457384613gh 先試試,報錯的話請先google, 不行的話再問。我當初也是這樣摸索出來的

@1457384613gh
Copy link

1457384613gh commented Sep 4, 2023

井井有条 欸。
多谢大佬悉心整理!
我明天试试。

@1457384613gh
Copy link

@supechicken
我又改了一下。
都快两个小时了。
要构建那么那么那么长时间的吗????
image
image
image

@supechicken
Copy link
Contributor

vim 是交互性的(有鍵盤才能用),在腳本中請用 sed

@1457384613gh
Copy link

vim 是交互性的(有鍵盤才能用),在腳本中請用 sed

你的意思是,卡到 vim 那里了,vim 那里没保存没退出,所以一直无法下一步,所以无限计时是吗是吗?

那岂不是有玩崩 github 服务器,浪费服务器资源的风险?

@supechicken
Copy link
Contributor

對,不過 github ci 在公開 repo 上是無限任用的,不用太擔心

@1457384613gh
Copy link

@supechicken
编译出来的是 vmlinux,
如果我想要 vmlinuz,带压缩的,怎么弄啊?
image

@tiann
Copy link
Owner

tiann commented Sep 13, 2023

我开启了 Discussion,请移步这里讨论:https://github.com/tiann/KernelSU/discussions 不要在 issue 下讨论 off-topic 的问题。

@1457384613gh
Copy link

我开启了 Discussion,请移步这里讨论:https://github.com/tiann/KernelSU/discussions 不要在 issue 下讨论 off-topic 的问题。

好的,多谢。

@tiann
Copy link
Owner

tiann commented Sep 13, 2023

这个 issue 我会 lock,如果依然有兴趣并希望解决 ChromeOS 里面的这个问题,欢迎另开 issue。

@tiann tiann closed this as not planned Won't fix, can't repro, duplicate, stale Sep 13, 2023
Repository owner locked as off-topic and limited conversation to collaborators Sep 13, 2023
natsumerinchan added a commit to natsumerinchan/KernelSU that referenced this issue Oct 18, 2023
natsumerinchan added a commit to natsumerinchan/KernelSU that referenced this issue Oct 20, 2023
natsumerinchan added a commit to natsumerinchan/KernelSU that referenced this issue Oct 20, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

5 participants