Run shell command with root permissions from AOSP apk

  • Replies:0
1
Martin O
  • Forum posts: 1

Oct 18, 2017, 6:25:01 PM via Website

Hello,

I would like to ask for help with get root access for AOSP apk broadcast receiver.

I need receive event for change date/time and I need run my shell command for write system time to hardware RTC.

I have chosen follow principe:
- I wrote Android myBR.apk in AOSP with broadcast receiver for TIME_SET, TIMEZONE_CHANGED
- From myBR.apk I run my shell command (rtcclock -w)
- "rtcclock -w" shell command which is write system time from Android to RTC via /dev/rtc0 -> ioctl( i2c )

**My problem is:

I need run shell command rtcclock from AOSP myBR.apk as root.
My all attempts were unsuccessful.
I would like to ask for help from some experts how can I resolve this problem.**

Environment info (everything in Android shell terminal)

Android device is not rooted

Permissions for su shell command
$ ls -lZ /system/xbin/su
-rwsr-x--- root shell u:object_r:su_exec:s0 su

SELinux status
$ getenforce
Disabled

Super user information
$ su
id
uid=0(root) gid=0(root) groups=1007(log)

Android version
$ cat /system/build.prop | grep "ro.build.version.release"
ro.build.version.release=5.1.1

Kernel version
$ cat /proc/version
Linux version 3.4.39 .....

Permissions for rtcclock shell command
$ ls -l /system/bin/rtcclock
-rwxr-xr-x root shell 13672 2017-10-18 09:53 rtcclock

Example for try write system time from Android to RTC as user = shell from
$ rtcclock -w
rtcclock: can't open '/dev/misc/rtc': No such file or directory

Example for try write system time from Android to RTC as user = system
$ su system
$ rtcclock -w
rtcclock: ioctl 0x4024700a failed: Permission denied

Example for try write system time from Android to RTC as user = root
$ su

rtcclock -w

successfull

My source code:

MyBroadcastReceiver.java

package com.example.mybr;

import android.content.BroadcastReceiver;
import android.content.Context;
import android.content.Intent;
import android.util.Log;

import java.io.DataInputStream;
import java.io.DataOutputStream;
import java.io.IOException;

public class MyBroadcastReceiver extends BroadcastReceiver {

private static final String TAG = "MyBroadcastReceiver";

public MyBroadcastReceiver() {
    super();
    Log.i( TAG, "MyBroadcastReceiver - created" );
}

@Override
public void onReceive( Context context, Intent intent )
{
    final String intentAction = intent.getAction();
    boolean bResult = false;

    if( intentAction.equals( Intent.ACTION_TIME_CHANGED ) ||
        intentAction.equals( Intent.ACTION_TIMEZONE_CHANGED ) )
    {
        bResult = runCmd( "sh", "id" );
        Log.i( TAG, "bResult = " + bResult );

        bResult = runCmd( "su", "id" );
        Log.i( TAG, "bResult = " + bResult );

        bResult = runCmd( "su", "rtcclock -w" );
        Log.i( TAG, "bResult = " + bResult );
    }
}


public static boolean runCmd( String...commands )
{
    boolean bResult = false;

    try
    {
        Process prcs = Runtime.getRuntime().exec( commands[ 0 ] );
        DataOutputStream cmdStream = new DataOutputStream( prcs.getOutputStream() );
        DataInputStream resStream = new DataInputStream( prcs.getInputStream() );
        DataInputStream errStream = new DataInputStream( prcs.getErrorStream() );

        if( cmdStream != null && resStream != null && errStream != null )
        {

            for( int n = 1; n < commands.length; n++ )
            {
                Log.d( TAG, "cmd: " + commands[ n ] );
                cmdStream.writeBytes( commands[ n ] + "\n" );
                cmdStream.flush();

                do
                {
                    String outputResult = resStream.readLine();
                    Log.d( TAG, "cmd result: " + outputResult );
                } while( resStream.available() > 0 );

                while( errStream.available() > 0 )
                {
                    String outputResult = errStream.readLine();
                    Log.d( TAG, "cmd error: " + outputResult );
                }
            }

            bResult = true;

            cmdStream.writeBytes( "exit\n" );
            cmdStream.flush();
            try
            {
                prcs.waitFor();
            } catch( InterruptedException e )
            {
                Log.i( TAG, "!!! EXCEPTION_1 !!!" );
                e.printStackTrace();
            }
        }
        if( cmdStream != null )
        {
            cmdStream.close();
        }
        if( resStream != null )
        {
            resStream.close();
        }
        if( errStream != null )
        {
            errStream.close();
        }
    }
    catch( IOException e )
    {
        Log.i( TAG, "!!! EXCEPTION_2 !!!" );
        e.printStackTrace();
    }

    return( bResult );
}

}

AndroidManifest.xml


package="com.example.mybr"
android:sharedUserId="android.uid.shell">

<application
    android:allowBackup="true"
    android:icon="@mipmap/ic_launcher"
    android:label="@string/app_name"
    android:supportsRtl="true">
    <receiver
        android:name=".MyBroadcastReceiver"
        android:enabled="true"
        android:exported="true">
        <intent-filter>
            <action android:name="android.intent.action.TIME_SET"/>
            <action android:name="android.intent.action.TIMEZONE_CHANGED"/>
        </intent-filter>
    </receiver>
</application>

Android.mk

LOCAL_PATH:= $(call my-dir)
include $(CLEAR_VARS)

LOCAL_MODULE_TAGS := optional

Only compile source java files in this apk.

LOCAL_SRC_FILES := $(call all-java-files-under, src)

LOCAL_PACKAGE_NAME := myBR
LOCAL_CERTIFICATE := platform
LOCAL_PRIVILEGED_MODULE := true

LOCAL_MODULE_PATH := $(TARGET_OUT)/priv-app

include $(BUILD_PACKAGE)

Use the following include to make our test apk.

include $(call all-makefiles-under,$(LOCAL_PATH))

Listing from logcat (as you can see su always failed)

10-28 14:08:28.821 455-455/system_process I/PackageManager: /system/priv-app/myBR changed; collecting certs
10-28 14:08:28.855 455-455/system_process I/art: DexFile_isDexOptNeeded file /system/priv-app/myBR/arm/myBR.odex needs to be relocated for /system/priv-app/myBR/myBR.apk
10-28 14:08:42.875 455-455/system_process I/art: DexFile_isDexOptNeeded file /system/priv-app/myBR/arm/myBR.odex needs to be relocated for /system/priv-app/myBR/myBR.apk
10-28 14:08:42.876 455-455/system_process I/PackageManager: Running patchoat on: com.example.mybr
10-28 14:08:42.878 631-631/? E/installd: Running /system/bin/patchoat isa=arm in-fd=5 (/system/priv-app/myBR/arm/myBR.odex) out-fd=6 (/data/dalvik-cache/arm/system@priv-app@myBR@myBR.apk@classes.dex)
10-03 14:11:47.001 455-501/system_process I/ActivityManager: Start proc 1795:com.example.mybr/2000 for broadcast com.example.mybr/.MyBroadcastReceiver
10-03 14:11:47.115 455-499/system_process W/InputMethodManagerService: Window already focused, ignoring focus gain of: com.android.internal.view.IInputMethodClient$Stub$Proxy@c92a0d7 attribute=null, token = android.os.BinderProxy@3515a383
10-03 14:11:47.181 1795-1795/com.example.mybr I/MyBroadcastReceiver: MyBroadcastReceiver - created
10-03 14:11:47.214 1795-1795/com.example.mybr D/MyBroadcastReceiver: cmd: id (added my note: runCmd( "sh", "id" );)
10-03 14:11:47.268 1795-1795/com.example.mybr D/MyBroadcastReceiver: cmd result: uid=2000(shell) gid=2000(shell) groups=1015(sdcard_rw),1023(media_rw),1028(sdcard_r),3002(net_bt),3008(net_bt_stack),9997(everybody),42000(u0_a32000)
10-03 14:11:47.275 1795-1795/com.example.mybr I/MyBroadcastReceiver: bResult = true
10-03 14:11:47.297 1795-1795/com.example.mybr D/MyBroadcastReceiver: cmd: id (added my note: runCmd( "su", "id" );)
10-03 14:11:47.306 1795-1795/com.example.mybr D/MyBroadcastReceiver: cmd result: null
10-03 14:11:47.309 1795-1795/com.example.mybr D/MyBroadcastReceiver: cmd error: su: permission denied (added mine detection: call function setgidI() return -1 from su.c)
10-03 14:11:47.310 1795-1795/com.example.mybr I/MyBroadcastReceiver: !!! EXCEPTION_2 !!!
10-03 14:11:47.310 1795-1795/com.example.mybr W/System.err: java.io.IOException: write failed: EPIPE (Broken pipe)
10-03 14:11:47.310 1795-1795/com.example.mybr W/System.err: at libcore.io.IoBridge.write(IoBridge.java:502)
10-03 14:11:47.310 1795-1795/com.example.mybr W/System.err: at java.io.FileOutputStream.write(FileOutputStream.java:186)
10-03 14:11:47.310 1795-1795/com.example.mybr W/System.err: at java.io.OutputStream.write(OutputStream.java:82)
10-03 14:11:47.310 1795-1795/com.example.mybr W/System.err: at java.io.DataOutputStream.writeBytes(DataOutputStream.java:156)
10-03 14:11:47.310 1795-1795/com.example.mybr W/System.err: at com.example.mybr.MyBroadcastReceiver.runCmd(MyBroadcastReceiver.java:77)
10-03 14:11:47.310 1795-1795/com.example.mybr W/System.err: at com.example.mybr.MyBroadcastReceiver.onReceive(MyBroadcastReceiver.java:33)
10-03 14:11:47.310 1795-1795/com.example.mybr W/System.err: at android.app.ActivityThread.handleReceiver(ActivityThread.java:2609)
10-03 14:11:47.310 1795-1795/com.example.mybr W/System.err: at android.app.ActivityThread.access$1700(ActivityThread.java:151)
10-03 14:11:47.310 1795-1795/com.example.mybr W/System.err: at android.app.ActivityThread$H.handleMessage(ActivityThread.java:1380)
10-03 14:11:47.311 1795-1795/com.example.mybr W/System.err: at android.os.Handler.dispatchMessage(Handler.java:102)
10-03 14:11:47.311 1795-1795/com.example.mybr W/System.err: at android.os.Looper.loop(Looper.java:135)
10-03 14:11:47.311 1795-1795/com.example.mybr W/System.err: at android.app.ActivityThread.main(ActivityThread.java:5254)
10-03 14:11:47.311 1795-1795/com.example.mybr W/System.err: at java.lang.reflect.Method.invoke(Native Method)
10-03 14:11:47.311 1795-1795/com.example.mybr W/System.err: at java.lang.reflect.Method.invoke(Method.java:372)
10-03 14:11:47.311 1795-1795/com.example.mybr W/System.err: at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:903)
10-03 14:11:47.311 1795-1795/com.example.mybr W/System.err: at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:698)
10-03 14:11:47.311 1795-1795/com.example.mybr W/System.err: Caused by: android.system.ErrnoException: write failed: EPIPE (Broken pipe)
10-03 14:11:47.311 1795-1795/com.example.mybr W/System.err: at libcore.io.Posix.writeBytes(Native Method)
10-03 14:11:47.311 1795-1795/com.example.mybr W/System.err: at libcore.io.Posix.write(Posix.java:258)
10-03 14:11:47.311 1795-1795/com.example.mybr W/System.err: at libcore.io.BlockGuardOs.write(BlockGuardOs.java:313)
10-03 14:11:47.311 1795-1795/com.example.mybr W/System.err: at libcore.io.IoBridge.write(IoBridge.java:497)
10-03 14:11:47.312 1795-1795/com.example.mybr W/System.err: ... 15 more
10-03 14:11:47.312 1795-1795/com.example.mybr I/MyBroadcastReceiver: bResult = true
10-03 14:11:47.337 1795-1795/com.example.mybr D/MyBroadcastReceiver: cmd: rtcclock -w (added my note: runCmd( "su", "rtcclock -w" );)
10-03 14:11:47.340 1795-1795/com.example.mybr D/MyBroadcastReceiver: cmd result: null
10-03 14:11:47.342 1795-1795/com.example.mybr D/MyBroadcastReceiver: cmd error: su: permission denied (added mine detection: call function setgidI() return -1 from su.c)
10-03 14:11:47.342 1795-1795/com.example.mybr I/MyBroadcastReceiver: !!! EXCEPTION_2 !!!
10-03 14:11:47.342 1795-1795/com.example.mybr W/System.err: java.io.IOException: write failed: EPIPE (Broken pipe)
10-03 14:11:47.343 1795-1795/com.example.mybr W/System.err: at libcore.io.IoBridge.write(IoBridge.java:502)
10-03 14:11:47.343 1795-1795/com.example.mybr W/System.err: at java.io.FileOutputStream.write(FileOutputStream.java:186)
10-03 14:11:47.343 1795-1795/com.example.mybr W/System.err: at java.io.OutputStream.write(OutputStream.java:82)
10-03 14:11:47.343 1795-1795/com.example.mybr W/System.err: at java.io.DataOutputStream.writeBytes(DataOutputStream.java:156)
10-03 14:11:47.343 1795-1795/com.example.mybr W/System.err: at com.example.mybr.MyBroadcastReceiver.runCmd(MyBroadcastReceiver.java:77)
10-03 14:11:47.343 1795-1795/com.example.mybr W/System.err: at com.example.mybr.MyBroadcastReceiver.onReceive(MyBroadcastReceiver.java:36)
10-03 14:11:47.343 1795-1795/com.example.mybr W/System.err: at android.app.ActivityThread.handleReceiver(ActivityThread.java:2609)
10-03 14:11:47.343 1795-1795/com.example.mybr W/System.err: at android.app.ActivityThread.access$1700(ActivityThread.java:151)
10-03 14:11:47.343 1795-1795/com.example.mybr W/System.err: at android.app.ActivityThread$H.handleMessage(ActivityThread.java:1380)
10-03 14:11:47.343 1795-1795/com.example.mybr W/System.err: at android.os.Handler.dispatchMessage(Handler.java:102)
10-03 14:11:47.343 1795-1795/com.example.mybr W/System.err: at android.os.Looper.loop(Looper.java:135)
10-03 14:11:47.343 1795-1795/com.example.mybr W/System.err: at android.app.ActivityThread.main(ActivityThread.java:5254)
10-03 14:11:47.343 1795-1795/com.example.mybr W/System.err: at java.lang.reflect.Method.invoke(Native Method)
10-03 14:11:47.343 1795-1795/com.example.mybr W/System.err: at java.lang.reflect.Method.invoke(Method.java:372)
10-03 14:11:47.343 1795-1795/com.example.mybr W/System.err: at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:903)
10-03 14:11:47.343 1795-1795/com.example.mybr W/System.err: at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:698)
10-03 14:11:47.343 1795-1795/com.example.mybr W/System.err: Caused by: android.system.ErrnoException: write failed: EPIPE (Broken pipe)
10-03 14:11:47.344 1795-1795/com.example.mybr W/System.err: at libcore.io.Posix.writeBytes(Native Method)
10-03 14:11:47.344 1795-1795/com.example.mybr W/System.err: at libcore.io.Posix.write(Posix.java:258)
10-03 14:11:47.344 1795-1795/com.example.mybr W/System.err: at libcore.io.BlockGuardOs.write(BlockGuardOs.java:313)
10-03 14:11:47.344 1795-1795/com.example.mybr W/System.err: at libcore.io.IoBridge.write(IoBridge.java:497)
10-03 14:11:47.344 1795-1795/com.example.mybr W/System.err: ... 15 more
10-03 14:11:47.344 1795-1795/com.example.mybr I/MyBroadcastReceiver: bResult = true
10-03 14:11:47.354 1388-1388/com.android.deskclock V/AlarmClock: AlarmInitReceiver android.intent.action.TIME_SET
10-03 14:11:47.384 1388-1647/com.android.deskclock V/AlarmClock: AlarmInitReceiver finished
10-03 14:11:47.395 455-498/system_process I/ActivityManager: Killing 1368:com.android.music/u0a33 (adj 15): empty #17
10-03 14:11:47.408 455-455/system_process W/MediaSessionRecord: Removing dead callback in pushEvent.
android.os.DeadObjectException
at android.os.BinderProxy.transactNative(Native Method)
at android.os.BinderProxy.transact(Binder.java:496)
at android.media.session.ISessionControllerCallback$Stub$Proxy.onSessionDestroyed(ISessionControllerCallback.java:189)
at com.android.server.media.MediaSessionRecord.pushSessionDestroyed(MediaSessionRecord.java:667)
at com.android.server.media.MediaSessionRecord.access$3800(MediaSessionRecord.java:67)
at com.android.server.media.MediaSessionRecord$MessageHandler.handleMessage(MediaSessionRecord.java:1286)
at android.os.Handler.dispatchMessage(Handler.java:102)
at android.os.Looper.loop(Looper.java:135)
at com.android.server.SystemServer.run(SystemServer.java:269)
at com.android.server.SystemServer.main(SystemServer.java:170)
at java.lang.reflect.Method.invoke(Native Method)
at java.lang.reflect.Method.invoke(Method.java:372)
at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:903)
at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:698)

Thank you very much for help.

Reply