1、路径:
android6.0\system\extras\su\su.c
修改:
int main(int argc, char** argv) {
uid_t current_uid = getuid();
- //if (current_uid != AID_ROOT && current_uid != AID_SHELL) error(1, 0, "not allowed");
2、路径:
android6.0\system\core\init\init.cpp
修改:
static bool selinux_is_disabled(void)
{
if (ALLOW_DISABLE_SELINUX) {
if (access("/sys/fs/selinux", F_OK) != 0) {
// SELinux is not compiled into the kernel, or has been disabled
// via the kernel command line "selinux=0".
return true;
}
- //return selinux_status_from_cmdline() == SELINUX_DISABLED;
+ return true;
}
return false;
}
3、路径:
android6.0\frameworks\base\core\jni\com_android_internal_os_Zygote.cpp
修改:
static void DropCapabilitiesBoundingSet(JNIEnv* env) {
+/*
for (int i = 0; prctl(PR_CAPBSET_READ, i, 0, 0, 0) >= 0; i++) {
int rc = prctl(PR_CAPBSET_DROP, i, 0, 0, 0);
if (rc == -1) {
if (errno == EINVAL) {
ALOGE("prctl(PR_CAPBSET_DROP) failed with EINVAL. Please verify "
"your kernel is compiled with file capabilities support");
} else {
ALOGE("prctl(PR_CAPBSET_DROP) failed");
RuntimeAbort(env);
}
}
}
+*/
}
4、路径:
android6.0\frameworks\base\cmds\app_process\app_main.cpp
修改:
int main(int argc, char* const argv[])
{
+/*
if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
// Older kernels don't understand PR_SET_NO_NEW_PRIVS and return
// EINVAL. Don't die on such kernels.
if (errno != EINVAL) {
LOG_ALWAYS_FATAL("PR_SET_NO_NEW_PRIVS failed: %s", strerror(errno));
return 12;
}
}
+*/
AppRuntime runtime(argv[0], computeArgBlockSize(argc, argv));
// Process command line arguments
// ignore argv[0]
argc--;
argv++;
5、路径:
android6.0\system\core\libcutils\fs_config.c
修改:
-//{ 04750, AID_ROOT, AID_SHELL, 0, "system/xbin/su" },
+{ 06755, AID_ROOT, AID_SHELL, 0, "system/xbin/su" },
参考:
https://blog.csdn.net/alianqiugui/article/details/79392101
https://blog.csdn.net/q1183345443/article/details/77711643