[Security Discussion] bibikalka:
I would like to try this on an LG phone : LS676 ( ro.product.cpu.abilist=armeabi-v7a,armeabi ) I've tried a few Dirty Cow tricks, but was not able to get any root. Basically, "run-as" fails for "sh", so no root prompt emerges (however limited). Although "run-as -exec id" claims root privileges.

Also, recovery needs to be signed (the Dirty Cow trick did not work either):

http://xdaforums.com/showpost.php?p=69966761&postcount=42

As a non-root, I cannot read /init. So it's not clear how to try this galaxy s7 trick without /init access.

I've attached build.prop, sepolicy, and the output of "ls -laZ system/bin" in the zip file below.

Any suggestions on what else I could try ? Is there any device that this one is closest to ?

Thanks in advance!

This is build.prop (for convenience) :

# begin build properties
# autogenerated by buildinfo.sh
ro.build.id=MXB48T
ro.build.display.id=MXB48T
ro.build.version.incremental=162241609d25d
ro.build.version.sdk=23
ro.build.version.preview_sdk=0
ro.build.version.codename=REL
ro.build.version.all_codenames=REL
ro.build.version.release=6.0.1
ro.build.version.security_patch=2016-08-01
ro.build.version.base_os=
ro.build.date=Thu Aug 11 16:13:20 KST 2016
ro.build.date.utc=1470899600
ro.build.type=user
ro.build.user=jenkins
ro.build.host=LGEACI8R10
ro.build.tags=release-keys
ro.build.flavor=k6b_spr_us-user
ro.product.model=LGLS676
ro.product.brand=lge
ro.product.name=k6b_spr_us
ro.product.device=k6b
ro.product.board=msm8909
# ro.product.cpu.abi and ro.product.cpu.abi2 are obsolete,
# use ro.product.cpu.abilist instead.
ro.product.cpu.abi=armeabi-v7a
ro.product.cpu.abi2=armeabi
ro.product.cpu.abilist=armeabi-v7a,armeabi
ro.product.cpu.abilist32=armeabi-v7a,armeabi
ro.product.cpu.abilist64=
ro.product.manufacturer=LGE
ro.product.locale=en-US
ro.wifi.channels=
ro.board.platform=msm8909
# ro.build.product is obsolete; use ro.product.device
ro.build.product=k6b
# Do not try to parse description, fingerprint, or thumbprint
ro.build.description=k6b_spr_us-user 6.0.1 MXB48T 162241609d25d release-keys
ro.build.fingerprint=lge/k6b_spr_us/k6b:6.0.1/MXB48T/162241609d25d:user/release-keys
ro.build.characteristics=default
ro.lge.lguiversion=5.0
# end build properties
#
# from device/qcom/msm8909/system.prop
#
#
# system.prop for msm8909
#

#rild.libpath=/system/lib/libreference-ril.so
rild.libpath=/system/vendor/lib/libril-qc-qmi-1.so
rild.libargs=-d /dev/smd0
persist.rild.nitz_plmn=
persist.rild.nitz_long_ons_0=
persist.rild.nitz_long_ons_1=
persist.rild.nitz_long_ons_2=
persist.rild.nitz_long_ons_3=
persist.rild.nitz_short_ons_0=
persist.rild.nitz_short_ons_1=
persist.rild.nitz_short_ons_2=
persist.rild.nitz_short_ons_3=
ril.subscription.types=NV,RUIM
DEVICE_PROVISIONED=1
# Start in cdma mode
# TODO: Please DO NOT enable the next line when you merge CAF
#ro.telephony.default_network=5

debug.sf.hw=1
debug.egl.hw=1
debug.composition.type=gpu
debug.hwc.dynThreshold=2.5
debug.mdpcomp.logs=0
dalvik.vm.heapsize=36m
dalvik.vm.zygotemaxfailedboots=5
dev.pm.dyn_samplingrate=1
persist.demo.hdmirotationlock=false

#enable dirty rect
debug.sf.swaprect=1
#enable app buffer composition
debug.sf.hwc.canUseABC=1

#enable gpu perf hint
sys.hwc.gpu_perf_mode=1
#ro.hdmi.enable=true
#tunnel.decode=true
#tunnel.audiovideo.decode=true
#lpa.decode=false
#lpa.use-stagefright=true
#persist.speaker.prot.enable=false

#
# system props for the cne module
#
persist.cne.feature=1

#system props for the MM modules
media.stagefright.enable-player=true
media.stagefright.enable-http=true
media.stagefright.enable-aac=true
media.stagefright.enable-qcp=true
media.stagefright.enable-fma2dp=true
media.stagefright.enable-scan=true
mmp.enable.3g2=true
media.aac_51_output_enabled=true
#codecs:(PARSER_)AAC AC3 AMR_NB AMR_WB ASF AVI DTS 3GP 3G2 MKV MP2PS MP2TS MP3 OGG QCP WAV FLAC
mm.enable.qcom_parser=262143
# Default to AwesomePlayer
media.stagefright.use-awesome=false

#
# system props for the data modules
#
ro.use_data_netmgrd=true
persist.data.netmgrd.qos.enable=true
persist.data.mode=concurrent

#system props for time-services
persist.timed.enable=true

#
# system prop for opengles version
#
# 196608 is decimal for 0x30000 to report version 3
ro.opengles.version=196608

# System property for cabl
# if you need to add cabl feature you should add this property into /device/lge/MODEL/device.mk file
# ro.qualcomm.cabl=2

# System property for QDCM
persist.tuning.qdcm=1

# System property for Screen Color
ro.qcom.screencolor=1

#
# System props for telephony
# System prop to turn on CdmaLTEPhone always
#telephony.lteOnCdmaDevice=1

#Simulate sdcard on /data/media
#
persist.fuse_sdcard=true

#
# System property for Camera
# System prop to allocate Reprocess buffer as "1"
# during Longshot usecase
persist.camera.longshot.stages=1

#
# dirty ratio value when enable ums
#
ro.sys.umsdirtyratio=20

#
#snapdragon value add features
#
ro.qc.sdk.audio.ssr=false
##fluencetype can be "fluence" or "fluencepro" or "none"
#ro.qc.sdk.audio.fluencetype=none
persist.audio.fluence.voicecall=true
persist.audio.fluence.voicerec=false
persist.audio.fluence.speaker=true
#Set for msm8909
tunnel.audio.encode = false
ro.config.low_ram=false
#Buffer size in kbytes for compress offload playback
audio.offload.buffer.size.kb=64
#Minimum duration for offload playback in secs
audio.offload.min.duration.secs=30
#Enable offload audio video playback by default
#audio.offload.video=true
#enable voice path for PCM VoIP by default
use.voice.path.for.pcm.voip=true
#
#System property for FM transmitter
#
ro.fm.transmitter=false
#enable dsp gapless mode by default
audio.offload.gapless.enabled=true

#Audio voice concurrency related flags
voice.playback.conc.disabled=true
voice.record.conc.disabled=true
voice.voip.conc.disabled=true

#Audio VoIP / playback record concurrency flags
rec.playback.conc.disabled=true

#Set composition for USB
#persist.sys.usb.config=diag,serial_smd,rmnet_qti_bam,adb
#Set read only default composition for USB
#ro.sys.usb.default.config=diag,serial_smd,rmnet_qti_bam,adb

# set max background services
ro.config.max_starting_bg=8

#property to enable user to access Google WFD settings
persist.debug.wfd.enable=1
#propery to enable VDS WFD solution
persist.hwc.enable_vds=1

#property to enable image unload by audio HAL
sys.audio.init=false

#property to enable DS2 dap
audio.dolby.ds2.enabled=true

#property to change touch screen resolution
persist.sys.synaptics_dsx.qhd=false

#HWUI properties
ro.hwui.text_large_cache_height=2048

# enable sta proxy bydefault
persist.mm.sta.enable=1
#Trim properties
ro.sys.fw.use_trim_settings=true
ro.sys.fw.empty_app_percent=50
ro.sys.fw.trim_empty_percent=100
ro.sys.fw.trim_cache_percent=100
ro.sys.fw.trim_enable_memory=1073741824

#Enable Delay service restart
ro.am.reschedule_service=true

# set cutoff voltage to 3200mV
ro.cutoff_voltage_mv=3200

#min/max cpu in core control
ro.core_ctl_min_cpu=2
ro.core_ctl_max_cpu=4

#Enable B service adj transition by default
ro.sys.fw.bservice_enable=true
ro.sys.fw.bservice_limit=5
ro.sys.fw.bservice_age=5000

#set device emmc size
ro.emmc_size=8GB

#
# ADDITIONAL_BUILD_PROPERTIES
#
log.tag.GpsLocationProvider=DEBUG
log.tag.LocationManagerService=DEBUG
log.tag.NlpProxy=DEBUG
log.tag.LocSvc_java=DEBUG
log.tag.LgeGpsIndicator=DEBUG
log.tag.GeofenceHardwareImpl=DEBUG
log.tag.GeofenceManager=DEBUG
log.tag.FlpServiceProvider=DEBUG
log.tag.GeofenceProxy=DEBUG
ro.com.lge.mada=gms_3.1
ro.build.target_operator=SPR
ro.build.target_country=US
ro.telephony.default_network=10
telephony.lteOnCdmaDevice=1
persist.gsm.sms.disablelog=64
ro.lge.lcd_default_brightness=172
wifi.lge.common_hotspot=true
wlan.lge.softap5g=false
wlan.lge.supportsimaka=YES
persist.data.tethering_oc=1
wifi.lge.ftm_test=2
wlan.lge.powermode=false
wlan.lge.dcf.enable=true
wlan.lge.passpoint_setting=true
ro.config.max_starting_bg=32
ro.sys.fw.bg_apps_limit=21
ro.sys.fw.bg_cached_ratio=0.33
ro.sys.fw.mOomAdj1=0
ro.sys.fw.mOomAdj2=1
ro.sys.fw.mOomAdj3=2
ro.sys.fw.mOomAdj4=3
ro.sys.fw.mOomAdj5=9
ro.sys.fw.mOomAdj6=15
ro.sys.fw.mOomMinFree1=73728
ro.sys.fw.mOomMinFree2=92160
ro.sys.fw.mOomMinFree3=110592
ro.sys.fw.mOomMinFree4=153600
ro.sys.fw.mOomMinFree5=266240
ro.sys.fw.mOomMinFree6=327680
ro.lge.pnconfig=true
ro.lge.adoptable_storage=false
persist.sys.cust.waitsound=true
ro.movetosdcard.enable=true
persist.data.iwlan.enable=true
persist.sys.cnd.iwlan=2
persist.lg.data.iwlan=1
persist.lg.data.iwlan.conf=1
ro.sprint.rr.appenable=1
ro.qc.sdk.audio.fluencetype=fluence
persist.audio.fluence.voicecall=true
persist.audio.fluence.speaker=true
persist.audio.nsenabled=ON
persist.audio.spkcall_2mic=ON
persist.audio.headset_fluence=false
persist.audio.sm_fluence=OFF
persist.audio.spk_sm_fluence=OFF
persist.audio.voip_nsenabled=ON
persist.audio.voice.clarity=off
persist.audio.handset_rx_type=DEFAULT
ro.config.vc_call_vol_steps=7
ro.config.vc_call_vol_default=4
ro.lge.noise.suppression=0
ro.lge.bt_gain_control_factor=0.9
lge.fm_gain_control_headset=0.53
lge.fm_gain_control_speaker=0.98
ro.config.ringtone=01_Life_Is_Good.ogg
ro.config.notification_sound=Crystal.ogg
ro.config.alarm_alert=Life_Is_Good_Alarm.ogg
ro.config.timer_alert=Timer.ogg
ro.lge.vib_magnitude_index=0,1044,1276,1508,1740,1972,2088,2204
lge.normalizer.param=version2.0/true/8.6/true/19500/1.0/2900/0.55
ro.com.google.gmsversion=6.0_r5
ro.setupwizard.mode=DISABLED
ro.com.google.apphider=off
ro.lge.spr_chameleon.rootdir=/carrier/cust
ro.lge.spr_chameleon=true
ro.home.operator.carrierid=Chameleon
ro.cdma.home.operator.alpha=Chameleon
ro.cdma.home.operator.numeric=310000
ro.com.google.clientidbase=android-om-lge
ro.com.google.clientidbase.ms=android-sprint-mvno-us
ro.com.google.clientidbase.yt=android-sprint-mvno-us
ro.com.google.clientidbase.am=android-sprint-mvno-us
ro.com.google.clientidbase.gmm=android-om-lge
ro.setupwizard.launchtype=0
ro.itson=false
ro.chameleon.itson=0
ro.cnap.configstatus=-1
ro.cnap.oic=0
ro.sf.lcd_density=320
debug.composition.type=gpu
persist.sys.strictmode.disable=true
ro.lge.sensor_chip=qct_kernel
ro.build.display_manufacture_sn=1
persist.service.crash.enable=0
ro.frp.pst=/dev/block/bootdevice/by-name/config
voice.playback.conc.disabled=false
voice.record.conc.disabled=true
voice.voip.conc.disabled=true
persist.gralloc.cp.level3=1
persist.service.odm_log.noti=true
persist.service.odm_log.svc=true
persist.radio.apm_sim_not_pwdn=1
audio.offload.pcm.enable=false
persist.speaker.prot.enable=false
av.offload.enable=false
audio.dolby.ds2.enabled=false
use.voice.path.for.pcm.voip=false
ro.airplane.phoneapp=1
ro.lge.build.basetag=LAMPMMR1R160516
ro.lge.build.branch=msm8909_m_mr1_k6_qct_mp_160516
sys.knockon.knockoff.distance=10
ro.lge.lcd_auto_brightness_mode=false
ro.lge.audio_soundexception=true
sys.lge.bnrd=0
ro.lge.capp_ZDi_O=true
lge.zdi.actionsend=false
lge.zdi.onactivityresult=true
lge.zdi.dragdropintent=false
drm.service.enabled=true
lge.signed_image=true
persist.service.main.enable=0
persist.service.system.enable=0
persist.service.radio.enable=0
persist.service.events.enable=0
persist.service.kernel.enable=0
persist.service.packet.enable=0
persist.service.storage.low=0
persist.service.power.enable=0
persist.service.memory.enable=0
persist.service.ccaudit.enable=0
persist.service.xfrm.enable=0
ro.afwdata.LGfeatureset=SPCSBASE
persist.data_netmgrd_mtu=1422
persist.data_netmgrd_not_4g_mtu=1472
persist.qcril.disable_retry=true
persist.dpm.feature=0
persist.lg.data.fd=0
persist.telephony.oosisdc=false
persist.lg.data.llkklk.exact=true
ro.lge.swversion_arb=
ro.lge.swversion=LS676ZV3
ro.lge.swversion_short=ZV3
ro.lge.swversion_rev=00
ro.lge.factoryversion=LGLS676AT-00-ZV3-SPR-US-AUG-11-2016+00
dalvik.vm.heapgrowthlimit=128m
dalvik.vm.heapminfree=6m
ro.vendor.extension_library=libqti-perfd-client.so
persist.radio.sib16_support=1
ro.carrier=unknown
dalvik.vm.heapstartsize=8m
dalvik.vm.heapsize=256m
dalvik.vm.heaptargetutilization=0.75
dalvik.vm.heapmaxfree=8m
ro.boot.svelte=1
wlan.chip.vendor=qcom
wlan.chip.version=wcn
wifi.lge.patch=true
wlan.lge.concurrency=MCC
wlan.lge.wifidisplay=both
wlan.lge.traffic.trigger=100
persist.sys.dalvik.vm.lib.2=libart
dalvik.vm.isa.arm.variant=cortex-a7
dalvik.vm.isa.arm.features=default
net.bt.name=Android
dalvik.vm.stack-trace-file=/data/anr/traces.txt
persist.gps.qc_nlp_in_use=0
ro.gps.agps_provider=1
ro.expect.recovery_id=0x1c6f66201a6c6f0a23dfca127596de4c07f3e21e000000000000000000000000