[E 2015 General] kryz:
Persistent selinux permissive method

Thanks to the [MENTION=1939077]edjocute[/MENTION] user we know that overwrite system partition in raw is not possible in Moto E aisshhhhh ;)

Those days i was researching ways to keep the root in the reboot, but really is not easy with locked bootloader and system partition read only even writing to the device in raw.

But thinking that we have controlled the /data folder at least until the phone reboot, we can keep our permissive selinux policy persistent and this are good news for the root stability of your device Moto E.

So the theory is, i say theory because all the methods that are well tested in my devices are half working in Moto E:

1-Get root with the apk or adb exploit.

2-Create a new selinux folder in /data/security/current

3-Copy the files required to make a new selinux configuration to this folder.

Creating a new folder /data/security/current Android will load this configuration at boot overwriting the default config.

So in this new configuration we will give permissions to some file to set to permissive and give us a su root.

We will skip the init exploit because we already have controlled Selinux, probably we will fix the reboot issue and for sure the state of the phone will be more stable.

For this test i recommend again to have a RECOVERY WORKING SYSTEM WITH A STOCK ROM, also better try with the adb script to execute some commands faster.

First we get root with the adb or apk:

su
root@A51:/data/local/tmp #

We will patch the actual sepolicy with su permissions and some permissive domains we will use supolicy:

cd /data/local/tmp
export LD_LIBRARY_PATH=.
./supolicy --live

Now dump the actual policy permissive to /data/local/tmp/sepolicy_persistent:

./supolicy --save sepolicy_persistent

We will create the folder /data/security/current and copy the required files:

mkdir /data/security/current
cp /file_contexts /data/security/current/
cp /property_contexts /data/security/current/
cp /seapp_contexts /data/security/current/
cp /selinux_version /data/security/current/
cp /service_contexts /data/security/current/
cp /data/local/tmp/sepolicy_persistent /data/security/current/sepolicy

Now its time to reboot the phone and check if we have our selinux loaded, we will dirtycow just one file run-as again:

cd /data/local/tmp
./run-as-dirtycow /system/bin/run-as run-as-dirtycow

We can stop this process in 10 seconds, we have overwritten run-as with our trojan, lets execute to get a root:init shell.

run-as -s1
WARNING: linker: run-as: unused DT entry: type 0x6ffffffe arg 0x560
WARNING: linker: run-as: unused DT entry: type 0x6fffffff arg 0x1

Chek we are root:

shell@A51:/data/local/tmp # id
uid=0(root) gid=0(root) groups=1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats) context=u:r:init:s0

Then if we want su run-as with -s2 argument:

run-as -s2
WARNING: linker: run-as: unused DT entry: type 0x6ffffffe arg 0x560
WARNING: linker: run-as: unused DT entry: type 0x6fffffff arg 0x1

Check su:

9|shell@A51:/data/local/tmp # su
root@A51:/data/local/tmp #

If we get root just overwriting one binary in this case "run-as" is because we have a really persistent permissive selinux and the root should be more stable.

This process seems large but if is working i will implement in the adb and apk to achieve a more stable root bypassing the init overwrite.

Best regards,