With the new 4.3 binary I cannot enter su (Supervisory state)

[Sandor Lengyel]

I use it on Acer Apire One.

The SU mode on the ICS binary worked

[Sandor Lengyel]

I found the problem. Have to install SuperSu. Then su work, but supersu still does not work.

[Tony Tame]

How did you install supersu? My doesn't install it (failed).

[Greg McGee]

I couldn't get supersu to install: 

superuser installs but does nothing.

OTOH alt+F1 gives me a root shell, I suspect something simply needs tweaked in /etc/permissions/ to allow the user to use su 

Haven't had time to poke that tiger yet.

[Greg McGee]

no shell access set in /etc/permissions/platform.xml

I'm going to copy over the version from 4.2 and see if that does the trick...

[Greg McGee]

..or course nothing is ever simple.

[dscm]

using ADB shell and su worked fine for me........android-x86 4.3 

........???????????

[BitBooster]

@dscm su works! Only apk cannot elevate using su command...
...............????

[BitBooster]

Adding only just shell permission in /system/etc/permissions/platform.xml
didn't work it for me....

[Chih-Wei Huang]

Indeed 'su' doesn't work is a known issue in this release.
(will add it to the release note)
It is probably due to the new security policies
introduced in android 4.3. (file_contexts?)
Unfortunately I don't have enough time or
knowledge to find a good solution yet.

Patches are welcome.


2013/7/29 BitBooster <postvo...@yahoo.com>:

> @dscm su works! Only apk cannot elevate using su command...
> ...............????

--
Chih-Wei
Android-x86 project
http://www.android-x86.org

[fuzzy7k]

yeah, file_contexts are SELinux attributes. I've not dealt with it in android yet, but there are a few different modes that you can try. In strict mode, nothing will work unless it has been granted explicit permission. Targeted mode only does this in a targeted way. i.e. you want to limit what a boot service is allowed to do, you write a policy that grants it permission to do those things. If it tries to do anything else, it will fail. However, everything that has not been targeted runs unrestricted, like it used to. That would be the first thing to try. Even more effective is lowering the state that selinux is running, permissive or disabled. Permissive checks the rules, but does not enforce them.

Normally you can set all of this in /etc/selinux/config:
SELINUX=disabled|permissive|enforcing
SELINUXTYPE=targeted|strict

for a quick fix you can normally run setenforce 0 to put it permissive mode.

file_contexts are a part of the policy scheme. All files must have a label, or multiple label's, so that that the policy can know, for instance, if a particular service is allowed to read from it. A whole other level of file permission.

I read on the cyanogenmod rss feed that they are working on policies, so this might be something we can borrow from them, at least for superuser.

[dscm]

well that's a totally different issue than "I cannot enter su" which is what I addressed....

see here:

http://www.androidguys.com/2013/07/27/superuser-on-android-4-3-gets-sketchy/

[sol64]

try this permission manager....

http://pocketnow.com/2013/07/26/android-permission-controls

[Ralf ranfyy]

On Monday, July 29, 2013 6:12:22 PM UTC+2, sol64 wrote:

try this permission manager....

http://pocketnow.com/2013/07/26/android-permission-controls

Some explanations:
  http://www.androidpolice.com/2013/07/25/root-on-android-4-3-is-still-a-bit-broken-but-chainfires-supersu-works-and-heres-why/

[Sandor Lengyel]

Installed install supersu to 4.01 and than copy the related binary to 4.3 (/system/xbin/su)

On Saturday, July 27, 2013 8:03:42 AM UTC-7, Sandor Lengyel wrote:

[Greg McGee]

Tried that to no effect.

Thought:
This build seems to work quite well save for the permissions issues.

Has anyone:
1) Built and replaced JUST the kernel WITHOUT SELinux support?
simply turning it off in the init or via the shell living on VT1 doesn't seem sufficient.
(note to self any boot parameters)

2)Built the supporting SEAdmin app (for android-x86) to actually manage things?

[Greg McGee]

I don't suffer from being an optimist.
A masochistic streak helps.

(turning selinux off via a selinux=0 argument in grub had no apparent effect)

[fuzzy7k]

Has anyone:
1) Built and replaced JUST the kernel WITHOUT SELinux support?
simply turning it off in the init or via the shell living on VT1 doesn't seem sufficient.
(note to self any boot parameters)

 

If you look at the kernel config, it's already not built.

[fgdn17]

fyi -

https://android.googlesource.com/platform/external/sepolicy/+/android-4.3_r2.1/README