返利网站建设全网网站快速排名推广软件
一、为什么需要adb root权限
问题：Relese版本，默认adb访问会降级到shell权限，一些敏感操作不能进行，远程调试比较麻烦。且Release版本没有su模块，不能切换Root用户。
开启adb调试以后，默认进入adb是system权限，不能切换到root（因为Release没有集成su）.
有两种方式切换Root:
1) Release也集成su模块
2）默认Release版本adb 开启Root权限
二、开启adb ROOT权限
开启Root权限
ro.secure表示root权限，要开启Root权限，系统配置ro.secure=0 开启ROOT权限
2.1 编译时默认开启ROOT权限
build/make/core/main.mk
ifneq (,$(user_variant))# ==== modify begin ====# fix: zhouronghua default as root# Target is secure in user builds.ADDITIONAL_DEFAULT_PROPERTIES += ro.secure=0# ==== modify end ====ADDITIONAL_DEFAULT_PROPERTIES += security.perf_harden=1ifeq ($(user_variant),user)# ==== modify begin ==== fix: default as rootADDITIONAL_DEFAULT_PROPERTIES += ro.adb.secure=0# ==== modify end ====endif
user版本就是Releae版本，userdebug版本就是debug版本。
2.2 Zygote关闭权限降级
frameworks/base/core/jni/com_android_internal_os_Zygote.cpp
static void DropCapabilitiesBoundingSet(fail_fn_t fail_fn) {// ==== modify begin ==== zhouronghua #if 0for (int i = 0; prctl(PR_CAPBSET_READ, i, 0, 0, 0) >= 0; i++) {;if (prctl(PR_CAPBSET_DROP, i, 0, 0, 0) == -1) {if (errno == EINVAL) {ALOGE("prctl(PR_CAPBSET_DROP) failed with EINVAL. Please verify ""your kernel is compiled with file capabilities support");} else {fail_fn(CREATE_ERROR("prctl(PR_CAPBSET_DROP, %d) failed: %s", i, strerror(errno)));}}}#endif// ==== modify end ====}2.3 Android.bp允许暴力修改selinux权限
system/core/init/Android.bp
-DALLOW_PERMISSIVE_SELINUX=0 修改为 -DALLOW_PERMISSIVE_SELINUX=1
cc_defaults {name: "init_defaults",cpp_std: "experimental",sanitize: {misc_undefined: ["signed-integer-overflow"],},cflags: ["-DLOG_UEVENTS=0","-Wall","-Wextra","-Wno-unused-parameter","-Werror","-Wthread-safety","-DALLOW_FIRST_STAGE_CONSOLE=0","-DALLOW_LOCAL_PROP_OVERRIDE=0","-DALLOW_PERMISSIVE_SELINUX=1","-DREBOOT_BOOTLOADER_ON_PANIC=0","-DWORLD_WRITABLE_KMSG=0","-DDUMP_ON_UMOUNT_FAILURE=0",
2.4 init程序允许暴力修改selinux权限
system/core/init/Android.mk
ifneq (,$(filter userdebug eng,$(TARGET_BUILD_VARIANT)))
init_options += \-DALLOW_FIRST_STAGE_CONSOLE=1 \-DALLOW_LOCAL_PROP_OVERRIDE=1 \-DALLOW_PERMISSIVE_SELINUX=1 \-DREBOOT_BOOTLOADER_ON_PANIC=1 \-DWORLD_WRITABLE_KMSG=1 \-DDUMP_ON_UMOUNT_FAILURE=1
else
# ==== modify begin ==== zhouronghua allow permissive
init_options += \-DALLOW_FIRST_STAGE_CONSOLE=0 \-DALLOW_LOCAL_PROP_OVERRIDE=0 \-DALLOW_PERMISSIVE_SELINUX=1 \-DREBOOT_BOOTLOADER_ON_PANIC=0 \-DWORLD_WRITABLE_KMSG=0 \-DDUMP_ON_UMOUNT_FAILURE=0
# ==== modify end ====
endif
2.5 su程序权限提级
system/core/libcutils/fs_config.cpp
// the following two files are INTENTIONALLY set-uid, but they// are NOT included on user builds.{ 06755, AID_ROOT, AID_ROOT, 0, "system/xbin/procmem" },// ==== modify begin ==== zhouronghua su right improve{ 06755, AID_ROOT, AID_SHELL, 0, "system/xbin/su" },
2.6 修改su程序权限
system/core/rootdir/init.rc
chown system system /sys/devices/system/cpu/cpufreq/interactive/io_is_busychmod 0660 /sys/devices/system/cpu/cpufreq/interactive/io_is_busy# ==== modify begin ==== zhouronghua su rightchmod 6755 /system/xbin/su# ==== modify end ====2.7 su程序构建
system/extras/su/Android.mk
LOCAL_MODULE_PATH := $(TARGET_OUT_OPTIONAL_EXECUTABLES)# ==== modify begin ==== zhouronghua su as common module
LOCAL_MODULE_TAGS := optional
# ==== modify end ====
2.8 su程序去掉Root用户检测
system/extras/su/su.cpp
int main(int argc, char** argv) {// ==== modify begin ==== zhouronghua delete root shell check#if 0uid_t current_uid = getuid();if (current_uid != AID_ROOT && current_uid != AID_SHELL) error(1, 0, "not allowed");#endif// ==== modify end ====
2.9 关闭selinux.cpp强制安全检测
system/core/init/selinux.cpp
bool IsEnforcing() {// ==== modify start ==== zhouronghua 不需要强制安全检测return false;// ==== modify endif (ALLOW_PERMISSIVE_SELINUX) {return StatusFromCmdline() == SELINUX_ENFORCING;}return true;
}2.10 adb不降级采用ROOT访问
adbd启动时检查属性，决定是否进行权限降级到AID_SHELL
system/core/adb/daemon/main.cpp
static bool should_drop_privileges() {// ==== modify begin ====// fix: zhouronghua "adb root" not allowed, always drop privileges.if (!ALLOW_ADBD_ROOT && !is_device_unlocked()) return false;// ==== modifu end ====adb Root权限访问不需要降级。
2.11 安卓内核默认开启selLinux
kernel/configs/o-mr1/android-3.18/android-base.config
kernel/configs/o-mr1/android-4.4/android-base.config
kernel/configs/o-mr1/android-4.9/android-base.config
kernel/configs/o/android-3.18/android-base.config
kernel/configs/o/android-3.18/android-base.config
kernel/configs/o/android-4.4/android-base.config
kernel/configs/o/android-4.9/android-base.config
kernel/configs/p/android-4.14/android-base.config
kernel/configs/p/android-4.4/android-base.config
kernel/configs/p/android-4.9/android-base.config
kernel/configs/q/android-4.14/android-base.config
kernel/configs/q/android-4.19/android-base.config
kernel/configs/q/android-4.9/android-base.config
kernel/configs/r/android-4.14/android-base.config
kernel/configs/r/android-4.19/android-base.config
kernel/configs/r/android-5.4/android-base.config
CONFIG_XFRM_USER=y
# ==== modify begin ==== zhouronghua selinux
CONFIG_SECURITY_SELINUX_DEVELOP=y
# # ==== modify end ====