[Magisk] DiamondJohn:
:o :o :o :silly:

to every one who followed my posts, a huuuuge sorry.:o especially [MENTION=4667597]Didgeridoohan[/MENTION] [MENTION=4487388]jcmm11[/MENTION]who took the time to respond.

It has become clear, it was ME all along:o I was just going about my daily business when it occurred to me that I do have a boot script (one of about 27), which does a "clean" of specific file patterns, within specific paths. Low and behold, one of these is a clean of all "log" files in the "/cache" path. ie the two specific files that were missing (and the logcat recording file). I commented out the line, and its now all good:good:. It also explains why the test phone did not have the issue, since it was not running the boot scripts. Did I say I was sorry?:silly:

Hopefully, the next bit will help at least a little to redeem for the above confusion, on my part.:silly:

Because I was having issues with the logcat script, I had a little look into it, and found the following.

1. The existing script at https://www.didgeridoohan.com/magisk/MagiskHelp has the following code.

...snip...
logcat -f /cache/bootlog.log &
sleep 30
kill %1
...snip...

The "kill %1" is obviously attempting to kill the sub-shell started for the logcat. However, "%1" does not return the PID of the sub-shell. I think the script should use "$!"

2. The following, makes the above point irrelevant. Performing the sub-shell and then the kill is not required. The logcat does not actually need to be explicitly logged during the 30 seconds, but can simply be taken after the 30 seconds has transpired. The logcat gets logged regardless if you are recording the log at the time. So, in my script, I have changed the above to simply (using variables as parameters, and no sub-shell)

...snip...
sleep $logcat_length_sec;
logcat -d -f $temp_file_location/$temp_file_name;
...snip...

3. Another reason for not doing the kill, is that any logcat taken after the kill, will record the kill signal in plain sight, which could be used to alert any app that something that a rooted user could do, has happened. ie any app could identify the phone is rooted. Yes, I understand this script is not for use on every boot. But the code in step two avoids the root issue, while still providing the same results.

4. I have built an app, which among many other shell things, builds and instances a version of the above script, with a few extra options. Within the app, you can find the method in the menu "Magisk>Logcat Of Boot>Enable Script>/cache/data/media/0>300 seconds>30 seconds>Yes - only run the script ONCE" This will create the script in the Magisk post-fs script path. The items in blue are different options the user can set for how the script is created/run

This menu item is the first revision and is a WIP. But it works as is, and includes the above suggested changes. There are also a few other Magisk items in the Magisk menu, that I have enabled.

Also, in a similar vein to point 3 above, I also noticed that in my generated logcat, the following line is present:

01-18 15:08:04.662 486 486 W Binder:382_2: type=1400 audit(0.0:162): avc: denied { search } for name="2311" dev="proc" ino=22289 scontext=u:r:surfaceflinger:s0 tcontext=u:r:[B][COLOR="Red"]magisk[/COLOR][/B]:s0 tclass=dir permissive=0

So, again, there is "evidence" of the phone being rooted with Magisk, within the logcat, for any app to see.

Now, for me, I do not do any banking or such on my device, so it does not bother me that any app could see I'm rooted, but I thought I would mention it. I would assume I could "hide" this SELinux deny with a module / script to add the appropriate allow. But, as I said, its no issue for me.

FYI: Attached is an example of the full script as built and placed in the post-fs-data path by the app.