Custom kernel erroneously hides magisk su file

[maxdarksol]

---

Developer edit

Some custom kernels allow only writable su file, they hide su file from read-only partitions. Magisk 26 protected su as read-only, so the su file was lost.
we won't fix this.
more info: #6914 (comment)

---

Device:zuk z2plus
Android version:lineage OS 19.1(12L)
Magisk version name:d0c93842
Magisk version code:26101

Superuser lost after manager hibernate and wake,I must reboot make su back,but a few minutes later, Installed went N/A again.

magisk_log_2023-04-19T17.34.29.log
bugreport-lineage_z2_plus-SQ3A.220705.004-2023-04-19-18-17-18.zip
magisk_patched-26100_h2GFp.zip

It seems same as #6880
I test this build from @canyie #6880 (comment)
but after force stop magisk manager,installed went N/A too.

[yujincheng08]

maybe related:

04-19 18:17:42.994  1067  8897  8897 E Magisk  : read (0 != 4)

u:r:incidentd:s0               incidentd     8897  8897  2202       0      0 0                   0 Z  19   0      -   0  fg 00:00:00 app_process

Anyway, try and send log without zygisk enabled.

[maxdarksol]

26101 without zygisk log

magisk_log_2023-04-19T21.38.24.log

[canyie]

你知道怎么用 adb 吗？如果知道的话，可以试试在管理器显示“无法获取”的时候进入 adb shell 输入 su 回车看看能不能成功。

[yujincheng08]

你知道怎么用 adb 吗？如果知道的话，可以试试在管理器显示“无法获取”的时候进入 adb shell 输入 su 回车看看能不能成功。

不能，/system/bin/su 的挂载都没了

[canyie]

---Magisk Logs---
d0c93842 (-1)

有点奇怪，magisk -v 是正常的，然后执行 magisk -V 的时候 shell 死掉了？

[maxdarksol]

你知道怎么用 adb 吗？如果知道的话，可以试试在管理器显示“无法获取”的时候进入 adb shell 输入 su 回车看看能不能成功。

As yujinchen08 say, /system/bin/sh: su: inaccessible or not found

[yujincheng08]

What are the outputs of /system/bin/magisk -v and /system/bin/magisk -V?

BTW, you should be able to access root in adb by /system/bin/magisk su. Could you send /cache/magisk.log?

[maxdarksol]

What are the outputs of /system/bin/magisk -v and /system/bin/magisk -V?

BTW, you should be able to access root in adb by /system/bin/magisk su. Could you send /cache/magisk.log?

[magisk.log](https://github.com/topjohnwu/Magisk/files/11274517/magisk.log) [magisk.log.bak.log](https://github.com/topjohnwu/Magisk/files/11274519/magisk.log.bak.log)

[yujincheng08]

Please grant su access to shell (you can reboot to restore root access, dont launch magisk app and type su in adb shell, then grant root in the popup)

[yujincheng08]

04-19 14:47:05.041 2172 2174 D : create : /system/bin/su <- ./magisk BTW su is created as symlink, and magisk is mounted. When root lost, can you /system/bin/su?

[maxdarksol]

What are the outputs of /system/bin/magisk -v and /system/bin/magisk -V?

BTW, you should be able to access root in adb by /system/bin/magisk su. Could you send /cache/magisk.log?

[maxdarksol]

04-19 14:47:05.041 2172 2174 D : create : /system/bin/su <- ./magisk BTW su is created as symlink, and magisk is mounted. When root lost, can you /system/bin/su?

[maxdarksol]

Please grant su access to shell (you can reboot to restore root access, dont launch magisk app and type su in adb shell, then grant root in the popup)

不好意思，我可能搞错了，即便管理器显示当前超级用户有效，但是所有su授权实际都已失效，也不能通过adb shell /system/bin/su取得授权，/bin/magisk su可以得到授权

[yujincheng08]

show output of
ls -lahZ /system/bin/

[maxdarksol]

Please grant su access to shell (you can reboot to restore root access, dont launch magisk app and type su in adb shell, then grant root in the popup)

不好意思，我可能搞错了，即便管理器显示当前超级用户有效，但是所有su授权实际都已失效，也不能通过adb shell /system/bin/su取得授权，/bin/magisk su可以得到授权

我只能在重启后几秒内通过adb shell su获得root权限，即便没有打开manager，当我再试一次的时候，su就已经不见了

[yujincheng08]

看起来是被人删了

[maxdarksol]

看起来是被人删了

26000也是一样的问题，25200没问题。
前几天，一个小米max2也是一样，重启后很快会掉root权限，甚至第一次打开manager时已经是无法获取，重启又可能有。他的max2刷的crdroid9（Android13），我让他回magisk25.2了。
是否是因为这些旧设备内核太老？我的Z2plus是4.4内核的，他的MI MAX2是4.9内核，我用Lenovo Z6 pro(zippo)是4.14内核，使用26100没有这个问题，但是我的另一部Lenovo Z5S(jd2019)刷的pixel experience也是4.9内核，也没问题。

[maxdarksol]

另一个用户遭遇此问题，小米平板4，魔趣11。
分享酷安用户@殷熙濯 对【Magisk】的评论：在更新26.1之后，出现的问题
重启后的一两分钟内一切正常，然后就没root权限了，重启后问题100％复现。
挂载在lsp的模块（thanox）可以正常使用，通过面具直接授权的（r安装组件，mt文件管理器）无法正常运行 https://www.coolapk.com/feed/45416188 分享自【酷安App】

[adajoh99]

I also have this issue with 26.1.

su is present immediately after boot, but disappears some time after.

The time seems to be somewhat random - sometimes it has been only a few seconds, sometimes it has lasted minutes before su disappears.

Downgrading to 25.2 has fixed the issue for me.

Platform is Motorola G7 Plus (lake) running lineageOS 20.

[inphynithus]

I'm also having this problem, however I found a way to circumvent this.
This problem seems kinda random, it takes a few seconds to installed show N/A. But when I run a container in termux using this script here and let termux running in background, the installed status never show N/A.
But if the OOM killer kills Termux, then it shows N/A.

[vvb2060]

worker tmpfs is read only, any modification can only be done by the root process authorized by the user

[vvb2060]

kernel issue?

[yujincheng08]

i found a workaround for it, and may submit a pr to fix this issue. tho we hv no idea about the root cause. are all reports from customize kernels?

[yujincheng08]

@aviraxp says it may be caused by commit LineageOS/android_kernel_motorola_msm8998@0e52c8c. And looks like all reported kernels have picked this commit. please try to revert it first.

[aviraxp]

https://review.lineageos.org/c/LineageOS/android_kernel_motorola_msm8998/+/355841

Also reported in LineageOS discord.

[spiral009]

I have a kernel with kernelSU and on android i had magisk 24 after i update magisk to 26.1 the device stuck in a bootloop
But i didn't have a bootloop with magisk 24
i recompiled the kernel without kernelsu and it booted
worth mentioning...

[glibg10b]

@adajoh99 Can you still confirm that it works in 25.2? Just double checking before I downgrade

[adajoh99]

@adajoh99 Can you still confirm that it works in 25.2? Just double checking before I downgrade

@glibg10b Yes, I am still using 25.2 with no issues

[osm0sis]

@yujincheng08, @vvb2060, @canyie or @aviraxp, would chattr +i /system/bin/su keep the kernel from being able to remove/hide it from the filesystem?

[aviraxp]

I don't think so.

[LeeBinder]

Same thing here. Magisk v.25.2 (stable) from Jul 21, 2022 and Magisk Canary 2717feac (25209) from Mar 2, 2023 were still fine. Getting this error since Magisk v.26.0 all the way up to the very latest Canary from Actions. Occurring in LineageOS 18.1 (A.11) and 12 (A.13) on my Nokia 6.1. All fine again after downgrading to Magisk v.25.209.

No such issues on my Samsung with stock ROM which is rooted via Magisk v.27 just fine.

(On my Nokia, I need to stay on a lower version of LOS for now due to a LSPosed module incompatibility.

Also as expected it's not SELinux related because with both, Magisk v.25.2x and 26.0, getenforce echoes Enforcing, and setting SELinux to permissive doesn't change anything if rooted via Magisk 26+.)

I've looked at LineageOS Gerrirt: Revert "kernel: Only expose su when daemon is running" (355841). I admit I wouldn't know how to apply that patch from Motorola LOS to my Nokia LOS ROM, or even if that would've any chance to be successful.. I guess it would mean recompiling the ROM's kernel (?)

I see you've marked this issue here as "wontfix/ not our issue: This issue is caused by third-party like customized rom or module". Again, this was working before up to Magisk 25.210 so in a way it's a regression. Therefore, would it be possible to integrate a function into Magisk, querying for the condition (certain custom kernels), and if it's met, default back to the older Magisk 25.2 method, which obviously was/ is working for several of us? Which from what I understand is:

Magisk switches worker tmpfs dir to RO instead of RW for safety reasons and happens to satisfy MS_RDONLY check for su file, resulting in su file totally inaccessible.

Apart from that, is there anything I can do to facilitate solving this issue, like providing logs from both, my phone's ROM booted w/ Magisk v.25.209, then with v.26.0?

[LeeBinder]

@aviraxp @vvb2060 it's those lines in Magisk/native/src/core/bootstages.cpp, isn't it?

#82 xmount("worker", path, "tmpfs", 0, "mode=755");
#42 xmount(nullptr, path, nullptr, MS_REMOUNT | MS_BIND | MS_RDONLY, nullptr);

Can you please point me to the commit from 25209 to 25210 where worker tmpfs dir was changed from RW to RO/755? I tried but not knowing my way around in GitHub well enough wasn't able to find it. Thank you.

[mike855]

Hello, anyone found a workaround for this?