yashsingh1/xdaforums huggingface dataset:
[Nexus 6  General] doitright:
For the most part, it works.

There is a flaw *in* titanium backup that has a bad interaction with Superuser. The flaw is, in fact, a workaround/hack for a flaw in the blob-root. Figures, eh?

In any case, there is a workaround for the flaw added to seSuperuser/Superuser, which amounts to ignoring titanium backup when it asks to switch context and leaving it in the default context, which is the correct context to do its work. I don't recall if that patch made it into the most recent boot images or not.
[Nexus 6  General] doitright:
This root won't work with CM-13, *HOWEVER*, they are operating on a fork of the same original source as we are, so their root is actually open source. We can't share the code 1:1 with them, since theirs is very deeply integrated in things that really shouldn't be messed with.

I suggest doing a full manual reinstall with the factory 6.0.1 images, and a factory reset.

I suspect that during your unlocking process, the mandatory factory reset went south and left you in a bad state. A fresh factory reset *should* fix that.

Also note that installing Superuser.apk *before* the unlock was pointless, since Superuser.apk is installed to your data partition, which the unlocking process (factory reset) clears.
[Nexus 6  General] doitright:
Well that is actually a given. In fact, we want to disable persistence for sensitive altogether to the point where *EVERY* time some application requests it, the user MUST accept the request AND input their passcode.

Not only that, but we want to make all ACTIONS done during an su session (sensitive or not) fully logged.

One problem with persistent su requests is that it is conceivable that some application could perform some action that is completely legit, yet later on do something else that is nefarious, once a user has granted a permanent authentication. It is actually possible for the application to detect if it has been granted persistent authorization by checking the amount of *time* it takes for the request to be accepted -- user interaction is a lot slower than automatic authorization. Once it knows that it has a permanent auth, it can do bad things freely when the screen is off (because the root-toast notification won't be shown to the user). This is a very dangerous state that needs to be blocked.
[Nexus 6  General] doitright:
You know, you probably could just email the dev (stericson) and ask him for the code. He is generally supportive of open source work and has some root-related code on his github page at github.com/stericson

Especially given that he obviously isn't commercializing the code, and it is quite obviously old and unmaintained.
[Nexus 6  General] JavaTiggy:
So I have a fairly straightforward question regarding this root method. If I ever want to remove root for whatever reason I can just uninstall the superuser app and then flash a stock boot.img or is it more involved than that?
[Nexus 6  General] topaza:
You probably also have to flash stock system.img and maybe recovery.img, depending on what your apps with root access have changed on these partitions.
[Nexus 6  General] b8842dc0:
I've been using oandbackup, from the F-droid repo for almost two years. I'm very happy with it:

https://f-droid.org/repository/browse/?fdid=dk.jens.backup

* Forgot to mention that version 0.2.10 that is currently in F-Droid doesn't work well with Marshmallow. The developers have an "unofficial" release that fixes the Marshmallow issues. That version can be found here: https://github.com/jensstein/oandbackup/issues/108
[Nexus 6  General] doitright:
It is as simple as that!

Though I can't imagine why you would ever want to remove it... ;)
[Nexus 6  General] doitright:
Ok, so consider the recently imposed security measures; there is a secureboot, which has the capability of verifying the signature of the boot partition before booting it, and the boot partition, which validates the system partition for changes.

On a Nexus 6, the boot.img signatures aren't verified, on a 5x/6p they are, but you have the option of adding a custom signature to put it into "yellow" mode, which also spits out the fingerprint.

With a good selinux policy, regular root doesn't allow you to do anything like changing the signatures, or changing the selinux policy. In fact, OUR policy does NOT allow itself to be changed at all during runtime -- this is a stark contrast to the blob root, which advertises its incredibly dangerous "on the fly selinux policy rewriting" as a feature! In other words, with theirs, selinux is a barrier to be overcome, and you do so by turning it into a heroin junkie. With ours, selinux is a trusted friend you want to keep honest and sober.

So if some application you are running tries to change out the policy, it is denied. If it rewrites the boot partition, you get red flagged next reboot because the signature doesn't match (it won't be loaded before then, so it won't hurt you). The verity keys file is part of the boot partition, so if they try to change anything in the system partition, what happens is that any attempt to read any data that they've changed will result in I/O errors rather than returning the modified data.

Now of course, this is the end goal, we aren't all the way there just yet!

With the blob root, the same thing happens and you get this; malicious application tried to change out the policy... OK, rewrites the keys to something new, replaces the boot.img with the new verity keys, modifies the crap out of the system partition. When you reboot, it still yellow flags you, but you weren't fast enough to read the fingerprint and therefore didn't notice that your system is compromised and communicating all of your *ENCRYPTED* data to YOURCHOICEOF(anonymous|china|russia|NSA).
[Nexus 6  General] JavaTiggy:
Haha thanks, just in case I ever feel like taking an OTA in the rare occasion I don't flash a factory file that's all
[Nexus 6  General] TheDonXR:
Anyone have issues modifying the build.prop? Tried to do it using JRummy root explorer but it said it failed, the after it fails I go back in build.prop file and it is completely erased. Then of course I had to reflash system.img. This is after clean install and wipe. If you have succeeded in modifying the build.prop what method did you use?
[Nexus 6  General] Krzysiek_CK:
I use ES File Explorer File Manager and its build-in text editor. I was able to edit the build.prop file without any issues.
[Nexus 6  General] doitright:
I don't know how many times this needs to be said before it starts sinking in... the system partition is FULL. You can't save anything there until you delete some junk first.

Or do yourself a favor and save your prop edits to /data/local.prop instead.
[Nexus 6  General] topaza:
Thanks. Sounds interesting...

---------- Post added at 10:06 PM ---------- Previous post was at 10:03 PM ----------

You are totally right but even if the root access app cannot change se-policy and boot partition it still can access any data from other apps, sdcard, etc. So any "untrusted" root app has still access to my data...or am I missing something?

I know your root approach is much safer than any other root solution out there and I really appreciate your work. My point was that ANY root access is a risk when I cannot trust the apps that I grant root access...
[Nexus 6  General] jl33:
I've cleared cache in twrp and that managed to clear some space.
[Nexus 6  General] _that:
On /system? Unlikely. Actually totally impossible.
[Nexus 6  General] Adreaver:
I would like to know this as well. Stock aosp might be okay, but having no build prop tweaks for dpi or rotation would really hamstring a device like the n6/6p.

EDIT: and now I see the answer above.
[Nexus 6  General] TheDonXR:
Sweet got it thanks, did some more research, I was used to just adding it to the end of the build.prop file. But the system partition is at capacity, so what I did was deleted Hangouts from the system/app folder and then edited the build.prop. Then I just reinstall the Hangouts app from the play store. Worked great! Sorry for the redundant question, it had worked on 6.0 without modifying any other part of the system. Thanks for your help!
[Nexus 6  General] BreckZeBoulay:
Thanks to you [MENTION=6124077]doitright[/MENTION] !

I am testing this method and I don't succeed in having root.

My phone and his setup :

Nexus 5, TWRP for Multirom, fresh install of untouched AOSP 6.0.1_1 in secondary rom.

I follow the steps given in OP (manual install of supersu.apk, then reboot in recovery to install hammerhead-6.0.1-boot.img)

Reboot, then I have this notification :

The su binary is out of date (see screenshot)

Any idea ? Problem coming from secondary rom ?

EDIT :

Yes, issue is coming from secondary install.

No problem with primary install.

Sorry for inconvenience.
[Nexus 6  General] phhusson:
It's a MultiROM incompatibility. I tried contacting Tassadar, but no news
[Nexus 6  General] BreckZeBoulay:
Yes I am worried about the future of Multirom :(

It's a so powerfull tool !

Anyway, also thanks to you cher Pierre-Hugues ;)
[Nexus 6  General] doitright:
If you can see *exactly* what that "untrusted" application is doing with its access, so things like auditing the execution command by command, then there is no longer a need to trust it.

I frankly think that it is a terrible idea to grant trust to anything you don't actually trust.

But keep in mind that accessing your data is not nearly as much of a risk as taking unauthorized actions, modifying the system partition, etc.
[Nexus 6  General] IndiNix:
Just want to thank you for the great work, particularly for the pre-built binaries (for my nexus 5 and 6), as I'm lacking a machine to build with at the moment - to that end, my holidays would be complete if a binary for the Nexus 7 (razor) appeared..

Thanks in advance SantaRoot; I've been good this year, I promise! ;)
[Nexus 6  General] doitright:
Holy crap. I forgot about razor.

Out of sight, out of mind, I guess.

My build server isn't on at the moment, but I'll try to remember to flip the switch tonight and push out a build for those.

Aside; do you know if there are any kernel or ramdisk differences between razor and razorg? Or are the differences exclusively userspace? I'd like to avoid doing separate images for both if I can.
[Nexus 6  General] Kul_dood:
Thanks for your efforts. Will this superuser app work on Touchwiz roms?
[Nexus 6  General] Adreaver:
The way it's built right now is nexus only.

Presumably if Samsung released the source for a touchwiz rom you could adapt the build process and use it.

However, Samsung has never (to my knowledge) released ROM source, only kernel source, and even that is very rare.
[Nexus 6  General] zelendel:
You are very right. OEM never release their source for their roms. Google is even slowly going that way, with how they are abandoning the aosp based apps for their closed sourced versions. We have a better chance of turning Crystal Ave into a price casino.
[Nexus 6  General] doitright:
Contrary to popular belief, it actually CAN be adapted to various blobroms. The key differences are that (a) you can't build the sepolicy from source, since there is none, which means that you have to edit the binary policy. phhusson has code for this. (b) you have to unpack modify and repack the boot image rather than creating a new one from the aosp tree.

[MENTION=4604280]IndiNix[/MENTION]; I haven't forgot about that, just been really busy. This is not an easy time of year to find spare time :S
[Nexus 6  General] IndiNix:
Oh! There is no rush; just thought I'd mention it and wasn't sure how much work it would be - hope you find some time to relax in this holiday season. :)
[Nexus 6  General] androcraze:
With the Nexus 5 having a new ROM release (6.0.1_r9), who has an updated boot.img?
[Nexus 6  General] BreckZeBoulay:
I think there is no change in kernel between _r3 and _r9.

A solution has been found to grant root for Adaway ?
[Nexus 6  General] androcraze:
Check post #1:

http://xdaforums.com/showpost.php?p=39144524&postcount=1

There's a patch for "systemless".

I'll admit I haven't tried yet, as I haven't rooted my phone this go-around. Despite "requiring root", MOAAB seems to work nicely without it.
[Nexus 6  General] BreckZeBoulay:
I tried and it didn't work.

You try ? Works ?
[Nexus 6  General] androcraze:
MOAAB appears to work:

http://xdaforums.com/showpost.php?p=32276021&postcount=1

Did you mean that, or the AdAway patch?

As far as no changes to the kernel, there's more to boot.img than the kernel.

We ran into this a couple of ROMs ago on the N5 with systemless: despite there being no apparent changes between boot.img between ROM revisions, using an older version with the newer gave battery percentage issues.

I won't even attempt to install a systemless root without the boot.img from that exact ROM revision.
[Nexus 6  General] tekka-maki:
Been lurking for awhile, and think this is brilliant work by doitright.

All it's really missing is a windows GUI like Wug's tool.

For those of us that like pretty buttons, anyway to take shamu-6.0.1-boot, SuperUser.apk and stick it into his graphical front end i.e. zip it up and put it in Nexus Root Toolkit\data\Root_Files?
[Nexus 6  General] stokholm:
Does the boot image that worked for mmb29k work for mmb29s too (Nexus 6). The original boot images differ (verified with diff), so something changed.
[Nexus 6  General] doitright:
I absolutely WILL NOT be doing anything to promote use of any MS product.

Given how absolutely TRIVIAL this is to work with, if you are still having a hard time getting by without pretty buttons, I sincerely suggest that you stick with factory everything. No offense, but this just isn't meant for anyone who can't get themselves out of a bind if something goes wrong.

Maybe at a later incarnation.
[Nexus 6  General] doitright:
It would be incredibly difficult to guess at without knowing the nature of the failure you are having (i.e., what it shows on the screen, and applicable logs, being, of course, dmesg and logcat).

I can provide two possibilities off the top of my mind;

1) You have failed to heed the notifications regarding the system partition being filled to capacity. It is impossible to install a new file to the system partition without deleting something first. Make sure that you take the reserved space into account when you look at the available free space.

2) Author of that adaway program has implemented a hack for a poor binary implementation of root, resulting in inappropriate context switching and failure.

Note that all that these adblocking programs do, is copy a new hosts file into /system/etc/, so nothing special that you can't do on your own in a few seconds with access to a good hosts file.
[Nexus 6  General] tekka-maki:
It's not that. AIO tools just rule, and your Root method is preferred. Was just a suggestion I guess, down the road, your own tool perhaps, tremendous growth potential. Cheers buddy
[Nexus 6  General] phaze one:
I'm curious about this as well.
[Nexus 6  General] androcraze:
Interesting.... I thought more folks would have been complaining about this. It's a nice open source program that takes the headache out of adblocking.

I've upgraded Hammerhead to 6.0.1_r9, but I don't have a boot.img to play with that's been modified the "doitright" way. Are you going to update images? I'll gladly provide logcat logs and screenshots as needed.

I'm suspecting issue #2 as you listed, as the program works with "other" root implementations. The app is open and still in development, so there's a good chance that if enough information is provided, the author(s) might be able to tweak it.

Welcome back, BTW.
[Nexus 6  General] JavaTiggy:
Just thought I would mention that I just manually flashed MMB29S on my N6(Fi) and used this method again for root and everything went smoothly. Thanks!
[Nexus 6  General] IndiNix:
So, there are pre-built images from the seSuperuser git repo up at http://superuser.phh.me/ - and an app up on the play store here put up by Pierre-Hugues Husson.

Works nicely with the latest factory images on my nexus 5, 6 and 7 - and there are pre-built binaries for a number of other platforms.
[Nexus 6  General] taylorlee:
Hi, I manually flashed MMb29S as well on N6. Root checker and titanium backup both reports root is successful. However I cannot do freeze or restore on titanium backup. Can you please check for me if your titanium backup is working?

update:

Using the binaries in IndiNix's post works for me
[Nexus 6  General] JavaTiggy:
[MENTION=6124077]doitright[/MENTION]

Is there any chance you have some free time to create a new 6.0.1 boot img based off of MMB29S? Something seems to have changed and certain functions of TiBackup are no longer functioning after I manually flashed MMB29S and used the previous boot img with it.
[Nexus 6  General] IndiNix:
Two posts above yours are links to binaries built from the seSuperuser git, and include exactly what you're asking for.

:D
[Nexus 6  General] JavaTiggy:
Are these the same as the ones that [MENTION=6124077]doitright[/MENTION] had posted at the beginning of this thread? If they are then that is fine I was just looking for the same source as I started with hence my post.

Ignore that, I am finally on a computer and went to the github to see the files and see that everything is within the same git repo just in different directories. [MENTION=4604280]IndiNix[/MENTION] which img file do you use to get the same result as the ones [MENTION=6124077]doitright[/MENTION] posted?
[Nexus 6  General] IndiNix:
Ok, I'm a little confused by what you mean by this. I guess, read PHH's thread on xda for specifics about his part of the development work?

I mean, I'm using http://superuser.phh.me/nexus/shamu/MMB29S/boot-shamu-MMB29S-su-nocrypt-r163.img because I'm on a nexus device, a shamu, flashing the factory MMB29S system, and unencrypted.
[Nexus 6  General] Krzysiek_CK:
It did not work for me. SuperSU appeared to be working but System was only accessible in read only mode and files under System could not be modified or deleted. I started with the clean install of MMB29S.
[Nexus 6  General] IndiNix:
Why are you running SuperSU? As per the OP in this thread, get rid of it. Use PHH's Superuser app, also linked in my post; consider reading the thread for all this also linked above...
[Nexus 6  General] JavaTiggy:
Yeah, I get what you are saying I was just hoping to stick with one solution than combine two that may not be identical. I know [MENTION=6124077]doitright[/MENTION] based his off of the same base that PHH did but having already started with DIR's I was hoping to just get an updated boot img from him rather than looking elsewhere. Fortunately I don't use TiBackup all that much so it isn't a rush but I would still appreciate a MMB29S boot img from [MENTION=6124077]doitright[/MENTION] to keep things consistent.
[Nexus 6  General] IndiNix:
OK, I think there is some confusion going on here - the seSuperuser git repo linked in the OP is the same repo that PHH uses for these binary builds, period. I may well be mistaken, but this recent appearance of this comprehensive build-bot generated collection of binaries, and the absence of updates to the ones doitright had provided seemed to suggest to me that this will be the mechanism by which new binaries are made available from this repo from now on. Similarly for the superuser apk from PHH emerging on the play store.

I'd like to see an update on the state of things but in the interim, it is the same source, accomplishing the same goal.

(Much appreciated effort too!!) :)
[Nexus 6  General] androcraze:
I'm confused by it too. I was under the impression that PHH and DIR were accomplishing things with slightly different methods (I remember something about permissive vs. enforcing). I was desiring the enforcing (DIR?), and have been waiting for that.

If you know for a fact that the PHH boot.img binaries/method are the direction that seSuperUser method is taking, then we need to focus on that. If not, I'm guessing that DIR is busy and he'll get to it when he does. I'm not hounding PHH or DIR at this point.

I had issues with the "systemless" from the "other" root method, using an older boot.img with a newer release; despite everyone saying it would work, it gave headaches. I won't repeat the same mistake again.

I've tried the PHH boot.img with 6.0.1_r9 on my Nexus 5. I installed the APK, rebooted to recovery, and installed the image. When I install apps requiring root, I get the "toast" and approve "forever". When I try running the 3 root apps that I actually use, not of them work:

- AdAway 3.1, with and without the "systemless" patch: it installs fine, when I initially run I get the "toast" and I grant permission. I download the hosts, it does its magic and gives a "unable to write hosts file" (or something like that).

- No-Frills CPU Control: installs fine, get the proper "toast", approve, make my app settings, try to set them and get a "are you sure you've installed SuperUser?" error message.

- MatLog: Tried running this to capture the above two errors. Again, I get a "toast" and approve it. I get an eternal spinning progress circle with no results. I can move around inside the app: settings, etc. I can even initiate recording, but I just get an empty file.

I'm 3 for 3 on failures for the PHH method. Those are the 3 root apps I primarily use. I'm also using Amaze file manager; it "toasted" OK, and root appeared to set correctly within the app, but I didn't play with it.

Maybe I'm doing something wrong. PHH had the original boot.img, and I reverted-back fine. No hurries or worries. I'm making things work through TWRP.
[Nexus 6  General] IndiNix:
Ok, I should re-iterate that I know nothing at all for a fact, other than what I've read in this threads OP, and in PHH's thread.

There are some options for which boot-*.img you use:

I'm using the matching boot-*-nocrypt.img along with the latest factory image; as far as apps allowed superuser (and working just fine) I have AdAway (via symlink), BetterBatteryStats, LightFlow, PowerToggles, Ex Kernel Manager and a few other things. No problems with anything. This is on a Nexus 5, and a 6.

So I'm not sure where the problem is; I'd forgotten to uninstall the old superuser app on one of the devices, and had to re-install, in order to uninstall, and then actually install PHH's superuser, at which point things worked again.. so, not sure where the issue you're having is coming from, but hopefully things will get sorted in time for the next security patch, in a few weeks ;)
[Nexus 6  General] androcraze:
I tried the "user" boot.img. Perhaps I need to investigate the "eng" or the "nocrypt". Perhaps the "user" version makes too many sacrifices to keep Pay. I'll play again and post.

---------- Post added at 23:33 ---------- Previous post was at 23:01 ----------

Thank you, things appear to now work. The "user" boot.img was definitely the culprit; I switched to "eng" and all three apps (AdAway w/systemless patch, MatLog, and No-Frills CPU Control) work.

I've also added the PHH forumn to my subscriptions as well.

It's good having AdAway back; I've been using MOAAB to great effect, but AdAway gives much more control.
[Nexus 6  General] Krzysiek_CK:
I got it wrong. I was using PHH's Superuser app and it appeared the root apps were gaining root access through it but they were not able to make changes in the System folder. I used ES File Explorer File Manger, Link2SD, and AdFree. Also, I used boot-shamu-MMB29S-su-eng-r163.img.
[Nexus 6  General] istperson:
Writing the system partition is prohibited on enforcing kernels. So it's not which root you use, but if the root makes the kernel permissive or not.