Hacker News Reader

Comment by jmickey | Hacker News Reader

Well if you can run any executable as root, that sure counts as rooting in my book.

The advantage I see here is that you don't have to actually root your phone, which means that apps/games that check for root access would continue to work normally.

I've always wondered: what exactly are they checking for?

What's the difference between "I can become the root user on my phone whenever I want" and "My phone is rooted"?

Note: I'm asking as a GNU/Linux user, not as a phone user.

http://www.cs.ucr.edu/~zhiyunq/pub/ccs15_root_providers.pdf

2015-08-20. The document describes analysis performed on those apps which root your phone for you.

Thanks!

No problem! I don't do Android development of any kind and didn't trust my ability to properly explain it, but it's an interesting paper. :)

Sure, but as soon as it's patched out, you're back to no root.

Maybe I'm missing something here, but what stops you from putting a setuid "su" binary and keeping the root access, even if the kernel is upgraded?

You're root running in a limited selinux context.

I'm assuming that's because of the Android security model, rather than a limitation of the exploit itself?

edit: Apparently SETUID is disabled on Android:

  ... using kernel features that help block privilege escalation (e.g. NOSUID, NO_NEW_PRIVS).

source: https://lwn.net/Articles/609511/

also: https://unix.stackexchange.com/a/250806/95938

Are you saying that on Android, you can achieve UID=0 via this exploit, but still not write to anywhere important on the device?

What are these different "methods" listed in the table here?

https://github.com/dirtycow/dirtycow.github.io/wiki/PoCs

Can one of those methods allow me to write to some file in /etc? (Which is enough to grant me the access I want, unless selinux is just MAGIC.)

SELinux can still prevent you (even if you are `$UID=0`) from performing an operation such as writing to a file under `/etc`.

You would need to be able to `setenforce 0 `. A properly configured SELinux context can prevent you from doing that however we are starting to finally see some reports of dirtyc0w successfuly leading to `SELinux status: permissive` and permanent root.

Reply on news.ycombinator.com