I want to copy some files from it's own data folder(e.g. "/data/data/com.example.copy/") to "/data/local/tmp/". I can't access /data/local/tmp/ in my app. Is it possible to do it?
I don't have root access on my device.
Here's my code:
Process p=Runtime.getRuntime().exec("cat "+ this.getApplicationInfo().dataDir +"1.txt > /data/local/tmp/1.txt" );
p.waitFor();
No, you cannot do this from an application unless your device has something like a hacked su which lets you run a helper process as a more privileged user (ie, unless it is "rooted").
You should put the file somewhere else - such as the external storage. (If the adb shell is allowed to create directories under /data/local/tmp you might be able to create one there and chmod or chown it to give your app access, but that's non-portable across versions)
Or if you are merely trying to expose it, change the access permissions (someone will probably come along and point out the java constant for setting a file world readable is superficially deprecated, but actual disabling the capability would require a drastic change to the underlying operating system)
Related
I have 285 different networks between the different campus apartments for which I am trying to add network profile information to a series of Lenovo Tab4 10 TB-X304F so they may connect without having our Apartment Managers carry around a list of wifi passwords.
So far, I have created a custom wpa_supplicant.conf file with all of the network blocks for each of the networks across the campus. I have rooted the device. I have pushed this custom file to /sdcard/TWRP. I then copied the file from /sdcard/TWRP to /data/misc/wifi.
Now we run into my issue, it appears that this file is stored in at least 3 locations which I have currently found, /etc/wifi, /system/etc/wifi and /data/misc/wifi. The other part of the problem is that these files appear to be rewritten/overwritten on boot.
Which of these file locations should I be updating with my custom wpa_supplicant.conf file? How do I stop the file from being rebuilt on boot? Or, how do I make the process, which builds the file on boot, build it with the networks I want added?
Am I missing any other steps?
I have also tried running " wpa_supplicant -iwlan0 -c/sdcard/TWRP/wpa_supplicant.conf -B " as a command in the adb shell with super user permissions and didn't receive any output or confirmation. What am I misunderstanding about the wpa_supplicant command?
Just in case here are the settings currently in /data/misc/wifi/wpa_supplicant.conf which I have copied into my custom file:
ctrl_interface=/data/misc/wifi/sockets
disable_scan_offload=1
driver_param=use_p2p_group_interface=1
update_config=1
device_name=LenovoTB-X304F
manufacturer=LENOVO
model_name=Lenovo TB-X304F
model_number=Lenovo TB-X304F
serial_number=<SerialNumber>
device_type=10-0050F204-5
config_methods=physical_display virtual_push_button
p2p_disabled=1
pmf=1
external_sim=1
tdls_external_control=1
I do not really know much, but I can successfully edit/replace
/data/misc/wifi/wpa_supplicant.conf
provided that (1) I have the device in Aeroplane Mode and (2) I make sure that the file belongs to user "system" and group "wifi", and has permissions 660. If I forget (1) or (2), somehow the file reverts later to the one before editing/replacing or is reinitialized to virtually empty (I am not sure when either happened exactly, but I noticed both cases). I believe your use of TWRP is effectively equivalent to my use of Aeroplane Mode--but I am not aware that you can "chown" a file in TWRP. I never had to touch any of the other locations where the file can apparently be found.
For reference, the commands to get the right ownership and permissions should be
chmod 660 /data/misc/wifi/wpa_supplicant.conf
chown system:wifi /data/misc/wifi/wpa_supplicant.conf
Of course, all this needs one to be root.
I recently jumped into an android development tutorials and doing my own app for the sake of learning. I want to get root permissions within my code in a proper way. So not by calling /system/xbin/su but by using something like seteuid(0). Unfortunately seteuid method does not work for me.
I am testing app on a real device, which I rooted, enabled debugging mode and well I clearly see that when using a call to /system/xbin/su my app requests root permissions from system, which does not happen with seteuid and seteguid (setuid and setguid do not work either but I would not expect those to do it as they are capable only in lowering the permissions).
Please, advice on where to look for a proper code implementation for requesting root permissions like it would do a top notch developer. Maybe some native api call? Or does everyone just use a call to su to get the needed access?
The usual way in Linux of elevating privileges -- that is, to run an application with greater privileges than the logged-in user -- is to set the SUID flag on the executable (e.g., chmod ug+s ...). This will make the process take the identity of the binary's owner (usually root), rather than the logged-in user.
This is tricky to do effectively on Android, even on a rooted device. First, you won't be able to install an app using the usual (APK) mechanisms that includes binaries with SUID permissions. Second, an Android app is not an executable in the usual sense -- a single executable handles the launching of all apps.
Still, if you want to experiment on the command line, it should be possible to set the SUID flag on binaries, in at least some filesystem locations.
If you have a rooted Android, then very likely there is some infrastructure already in place to control privilege elevation. Most likely the "su" command will work (because there will be kernel mods to make it work), and it will be provided either with credentials or with some other way to control which apps can use it. I believe that, as you suggest, calling "su" is the usual way to do privilege elevation in apps on rooted Android. It is fraught with difficulties, however. There's a document https://su.chainfire.eu/ that explains how "su" is typically implemented in rooted Android devices, and gives some guidance on how to use it properly.
Just in case posting my solution to the problem which I did in Java (no native code is needed here):
protected void hideRoot() throws IOException, InterruptedException {
Process p = Runtime.getRuntime().exec("su");
DataOutputStream dos = new DataOutputStream(p.getOutputStream());
dos.writeBytes("mount -o remount,rw /system\n");
dos.writeBytes("mv /system/xbin/su /system/xbin/suhidden\n");
dos.writeBytes("exit\n");
dos.flush();
p.waitFor();
}
I have an app in Android that needs to modify the private databases of other apps using root. The current method works on all devices up to and including Lollypop, but seems to fail on Marshmallow devices due to SELinux.
To modify databases, the app does the following:
From root:
Copy target database to my app's folder preserving permissions and ownership (cp -p)
Change permissions (chmod 777)
From app, use SQLiteDatabase class to open database and execute queries
From root
Move back database and restore permissions
However, on Marshmallow, attempting to open the copied database with SQLiteDatabase fails and yields the follow AVC denial:
avc: denied { open } for path="/data/data/<my app package>/cache/<database>.db" dev="dm-0" ino=509488 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:app_data_file:s0 tclass=file permissive=0
The only thing I've tried is running chcon u:r:untrusted_app:s0 on the file as root, but it says permission denied.
Additionally, from what I've read here: https://source.android.com/security/selinux/, it appears that SELinux was set to enforcing mode in the 5.0 release, so how come this is only an issue now on 6.0 but wasn't on 5.0?
I have just completed something like this for one of my apps so it works on Android 7 on a Pixel device.
Like you, I copy the original database files to my app's location. Then I not only chmod them but I also chown/chgrp them to my app's uid. Finally, I chcon the database files to the context found for them in their original location. I am then able to access and manipulate them via SqliteDatabase classes in my app.
Once I am finished, I move the database files back to their original location, chown/chgrp them back to the owning app's uid, and restorecon them.
This is a giant pain. But it seems to work in my limited testing so far. But beware that in later versions of Android the toolbox commands seem to have been replaced with toybox commands and this really impacts the chown/chgrp. Toolbox versions allow changing of owner and group in the same command. Toybox does not so you must issue both chown and chgrp commands.
There may be other command changes as well. for example, on the Pixel, the grep command is now a stand-alone binary and NOT a part of toolbox or toybox.
you can turn off the enforcing mode and move to permissive mode using adb shell su 0 setenforce 0 through code.
In permissive mode you are allowed do to do whatever you would do on normal phone without SELinux.
Once the enforcing mode is turned off you can do whatever you were doing before.
I have android device with root and i try to implement some small app. This app need to read files from /proc/pid/net . I made it with Runtime.getRuntime().exec(new String[] { "su", "-c", "cat /proc/"+PID+ "/net/tcp6" }); but I must accept su -permission for each pid. There are some other possibilities how i can to read system files in android from my app? Something with FileReader? How can I get the su-permissions without exec -commando?
The exec command IS how you get su permissions. You might be able to chmod 777 the files you want and then they can likely be read via java. That, or you could move the files you want to read to the sdcard, or your apps data location and read them from there. Here is something very useful for root. You won't have to manually use the exec command each time, but RootTools does still use exec.
I believe if you do something like:
Process p = Runtime.getRuntime().exec("su");
you will get the root access.
And then you can do just:
p.getRuntime().exec("command");
and then you won't have to put the su in as long as that process is still active.
Though, I haven't done what I explained above (with the process) in quite some time, so I may be wrong. You may still have to include su each time. But either way, I'd recommend using RootTools.
I'm writing an application that should modify some files it doesn't have access to: another application's database, default.prop, etc.
Currently, it is done with "su" request and temporary "chmod 0777" to required files. But I think that's not the best solution.
Is there any preferable way to do such operations?
And how, for example, I should check if shell commands (chown, chmod, grep, find) are supported by toolbox (if there's not busybox)?