yashsingh1/xdaforums huggingface dataset:
[SuperR Kitchen] SuperR.:
v2.1.4.6 (Donate version)

Changes:

Get original file permissions, contexts, and capabilities from mounted system.img and vendor.img when extracting and choosing set_metadata perm type.

Changed permission for su binary in pre-rooted devices.

v1.1.3.6 (Standard version)

Changes:

Get original file permissions, contexts, and capabilities from mounted system.img and vendor.img when extracting and choosing set_metadata perm type.

Changed permission for su binary in pre-rooted devices.

NOTE: You will need to extract your system.img/vendor.img after the update to use the new permissions feature. There are 2 new dependencies, which I think were installed in Ubuntu 16.04 by default. getcap and bc.

The new permissions feature is only available on Linux. cygwin/wsl are not capable of mounting img files.

Big thanks to [MENTION=1162986]Captain_Throwback[/MENTION] for the write-up and big thanks to [MENTION=398245]LeeDroid[/MENTION], [MENTION=1186202]baadnewz[/MENTION], [MENTION=2605798]nkk71[/MENTION], [MENTION=4905624]j to the 4n[/MENTION], [MENTION=506238]OMJ[/MENTION], and [MENTION=3088420]tbalden[/MENTION] for figuring this out :)
[SuperR Kitchen] baadnewz:
[MENTION=5787964]SuperR.[/MENTION]

I tried the latest version generated metadata and seems there are still problems

C:\Users\Adrian>adb shell
error: exec '/system/bin/sh' failed: Permission denied

if its any help, see attached zip. working updater-script permission vs bad permission generated by latest kitchen version. Thats about all the info i have right now. Ill get back when i have more

EDIT:

Semes the problem is mode:

Latest version generates

set_metadata("/system/bin/app_process", "uid", 0, "gid", 2000, "mode", 755, "capabilities", 0x0, "selabel", "u:object_r:system_file:s0"

when it should be:

set_metadata("/system/bin/app_process", "uid", 0, "gid", 2000, "mode", 0755, "capabilities", 0x0, "selabel", "u:object_r:system_file:s0"

I changed them manually and all is good now
[SuperR Kitchen] Captain_Throwback:
Thanks for the fast update!

I have a question - if I wanted to use sparse_dat, did you build in setting the capabilities on the files that need them when the image is built? The setcap binary can do this, but I'm not sure how sparse_dat works. I do know that even using sparse_dat didn't preserve them previously, so I'm assuming they'd still need to be set manually at build time.
[SuperR Kitchen] SuperR.:
v2.1.4.7 (Donate version)

Changes:

Fixed mode in updater-script.

Add capabilities to local files when extracting system.img/vendor.img.

v1.1.3.7 (Standard version)

Changes:

Fixed mode in updater-script.

Add capabilities to local files when extracting system.img/vendor.img.

Fixed

This has been added now. Let me know how it goes :)
[SuperR Kitchen] Er. Aditya:
hi dev is the issue with mount fixed with version ?
[SuperR Kitchen] zainifame:
Hi dev, how about join multiple system_*.img ? Have u try to looking for this thanks :)
[SuperR Kitchen] SuperR.:
Your recovery.log had mount issues before the rom was flashed so I am not sure how to help. If you figure out what is causing it let me know and I will try to get it fixed.

I worked on this for a while, but gave up because I don't really have the time. I was able to join the files and mount but the journal is messed up so all the files end up misnamed in lost+found. I may look into it again if I get more time.
[SuperR Kitchen] dkionline:
[MENTION=5787964]SuperR.[/MENTION]

Failed to set capabilities on file `cap_block_suspend+ep' (Invalid argument)
The value of the capability argument is not permitted for a file. Or the file is not a regular (non-symlink) file

Got that 3 times by unpacking vendor.img
[SuperR Kitchen] SuperR.:
Please send:

1. /kitchen/superr_projectname/00_project_files/set_metadataV (if exists)

2. vendor.img
[SuperR Kitchen] dkionline:
[MENTION=5787964]SuperR.[/MENTION], https://www.mediafire.com/folder/4wn81m2eej0zu/P9filestore
[SuperR Kitchen] zainifame:
That's good news :laugh:, no problem sir i can wait :highfive:
[SuperR Kitchen] SuperR.:
Everything happened correctly, not sure what the error was about. I will suppress setcap error messages in the next version, but for now everything looks good (besides the error lol) :)
[SuperR Kitchen] Captain_Throwback:
[MENTION=5787964]SuperR.[/MENTION]

Tried sparse_dat and did a getcap after the flash completed, but unfortunately only one file got permissions set - run-as. The files for WiFi Calling (imsdatadaemon, etc.) didn't get any permissions set, which means it'll still be broken. Any idea how to get them all properly set? It feels like we're so close...
[SuperR Kitchen] SuperR.:
Are you also getting errors from setcap? If so, I think I found the problem but not sure how to fix it yet. Will have more time to look at it on Monday.

You can do a getcap on system right after extracting to see if they get set before building the rom. If so, then something in the build process is messing them up (possibly make_ext4fs). If not, I will keep working on it :)
[SuperR Kitchen] Captain_Throwback:
Nope, no errors from setcap. But I will do a getcap on the /system folder and see if everything looks right shortly.
[SuperR Kitchen] Captain_Throwback:
[MENTION=5787964]SuperR.[/MENTION]

Confirmed that the capabilities in my /system folder in the Kitchen ROM folder are correct:

throwback@QuadCore-SSD-BuildBox:~/android/SuperRs_Kitchen$ getcap -r superr_PME_2.38.617.6
superr_PME_2.38.617.6/system/bin/imsdatadaemon = cap_net_bind_service+ep
superr_PME_2.38.617.6/system/bin/run-as = cap_setgid,cap_setuid+ep
superr_PME_2.38.617.6/system/bin/pm-service = cap_net_bind_service+ep
superr_PME_2.38.617.6/system/bin/wcnss_filter = cap_block_suspend+ep
superr_PME_2.38.617.6/system/bin/ims_rtp_daemon = cap_net_bind_service+ep
throwback@QuadCore-SSD-BuildBox:~/android/SuperRs_Kitchen$

But I didn't get any setcap error when extracting or building. But apparently something is breaking it during the sparse_dat build or during the flash. I did get some system mounting errors in my recovery log, which were unexpected.
[SuperR Kitchen] SuperR.:
setcap is only used when extracting the img and not again. Since they are set correctly in your rom directory, it does seem something is happening during the build. My best guess is make_ext4fs. You could try the one I compiled last month from the latest AOSP source. Not sure if it will make a difference but may be worth a shot.

https://xdaforums.com/attachment.php?attachmentid=3973937&d=1482179678

Rename the existing tools/make_ext4fs to something else and copy the new binary and lib dir into tools.
[SuperR Kitchen] Captain_Throwback:
Well, using the make_ext4fs you posted made a difference, but now the results are more confusing:

htc_pmewl:/ # getcap -r /system
/system/bin/hostapd = cap_net_admin,cap_net_raw+ep
/system/bin/logd = cap_setgid,cap_audit_control,cap_syslog+ep
/system/bin/run-as = cap_setgid,cap_setuid+ep
/system/bin/surfaceflinger = cap_sys_nice+ep
htc_pmewl:/ #

So it's still not setting most of the capabilities, and now it added ones that weren't even there before? Not sure what this means, or how to fix it now...

EDIT: At least the run-as capabilities are consistent.
[SuperR Kitchen] tanish2k09:
Maybe the folder you are trying to mount from doesn't even exist. Go check for it in the TWRP file explorer.

I think there will not be any folder /1354xxx/

Try removing that and add the correct path to /by-name/system

In my case, the kitchen always adds /132xxx/ folder that doesn't even exist.
[SuperR Kitchen] SuperR.:
make_ext4fs does it's own thing based on the file_contexts file provided. I don't know how it works but it creates permissions for everything when it builds the img. I suppose it makes sense the newer version would have more capabilities baked in. I assume no matter what we change the local capabilities to they will still end up how make_ext4fs decides. However, this is not my field of expertise so perhaps there is a more reliable method for creating the system.img.

Can you be more specific? This is the first I have heard of this. The kitchen uses the lines from your device fstab to get this info. It does not make things up :p
[SuperR Kitchen] tanish2k09:
I have a nougat ROM flashed on my device. The current location of system block can be seen in attachment.

But, when I use any LP or MM ROM, the path is not the same. It becomes /dev/block/platform/mtk-msdc.0/by-name/system

It is different from the path in attachment.

So while building ROM from the kitchen, I always have to delete the /11230000.MSDC0 from all lines in updater script.

I use adb method of partition info detection. This happens every time.

However, if I'm on any non-N ROM, the kitchen adds correct by-name.
[SuperR Kitchen] russel5:
Problem solved. In last ubuntu selinux and all context are disabled by default.

[MENTION=5787964]SuperR.[/MENTION] hello. With your last update when i'm exrtact the system.img, i'm get this errors:

stat: can't get se context for /../../files bla bla

In my working directory 00_project_files in file set_metadata1 i'm see this

set_metadata("/system/bin/adsprpcd", "uid", 0, "gid", 2000, "mode", 0755, "capabilities", 0x0, "selabel", "?");
set_metadata("/system/bin/app_process", "uid", 0, "gid", 2000, "mode", 0755, "capabilities", 0x0, "selabel", "?");
set_metadata("/system/bin/app_process32", "uid", 0, "gid", 2000, "mode", 0755, "capabilities", 0x0, "selabel", "?");
set_metadata("/system/bin/ATFWD-daemon", "uid", 0, "gid", 2000, "mode", 0755, "capabilities", 0x0, "selabel", "?");
set_metadata("/system/bin/atrace", "uid", 0, "gid", 2000, "mode", 0755, "capabilities", 0x0, "selabel", "?");
set_metadata("/system/bin/audiod", "uid", 0, "gid", 2000, "mode", 0755, "capabilities", 0x0, "selabel", "?");
set_metadata("/system/bin/blkid", "uid", 0, "gid", 2000, "mode", 0755, "capabilities", 0x0, "selabel", "?");
set_metadata("/system/bin/bootanimation", "uid", 0, "gid", 2000, "mode", 0755, "capabilities", 0x0, "selabel", "?");

This is normal?

UPD. Ony one selabel exist in set_metadata - u:object_r:system_file:s0 (because it's write in set_meta_list2) all other files doesn't had selabel

This is bad (
[SuperR Kitchen] osm0sis:
Sounds like it's using the fs config/capability .h files just like mkbootfs does, so to support various OEM-specific files you'll have to patch the .h files like I do for AIK and build your own updated make_ext4fs.
[SuperR Kitchen] bigrammy:
Not directed at you but just for info. :o

Just to be clear for MediaTek device owners in general since there seems to be more and more joining the thread. :good:

Depending on your Custom recovery and Android Version you will no doubt find that the system, boot and stock recovery reported /by-name path can be and mostly is different while in Custom recovery.

So your Custom recovery may use any of these and you need to check them while in Custom recovery.

Older MTK format and used by most TWRP recovery's

/dev/block/platform/mtk-msdc.0/by-name/system

Most common and the official path reported by the system, boot, stock recovery, CWM recovery and CTR recovery (New Carliv Touch Recovery v5.7 and v6.6 Here)

/dev/block/platform/mtk-msdc.0/11230000.MSDC0/by-name/system

or Same as above but uses Lowercase msdc0 instead.

/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/system

In my case with the Infocus M808 I found it easier to update the Custom recovery to support backwards compatibility so it can now use either or.

Now I no longer need to modify each official ota or custom.zip accordingly. :D

I am pretty sure this could all be done via a .sh or the updater-script it's self but my grep "n" awk mastery is zero and it would probably also need the update-binary modifying to accommodate things so easier to mod the recovery in my case. :o

Where there are multiple Custom recovery versions for your device then you will need to specify the custom recovery to use or produce two versions of the updater-script. :(

I hope this clarify's things a little for those new to Mediatek :fingers-crossed:
[SuperR Kitchen] Er. Aditya:
run_program("/sbin/mount", "-t", "auto", "/system");
run_program("/sbin/mount", "-t", "auto", "/data");

this fixed the issue for me for mounting
[SuperR Kitchen] SuperR.:
If either of you (or anyone else) would like to do an experiment, you can try the following:

download this file

replace slotdetect.sh in your rom config directory with the slotdetect.sh in the zip

Change the lines in your updater-script containing this from:

"/dev/block/platform/mtk-msdc.0/11230000.MSDC0/by-name/system" + file_getprop("/tmp/slotsel", "slotnum")

to this:

file_getprop("/tmp/slotsel", "byname") + "/system" + file_getprop("/tmp/slotsel", "slotnum")

When the line says boot, vendor, data, etc instead of system, replace as needed.

Finished examples:

format("ext4", "EMMC", file_getprop("/tmp/slotsel", "byname") + "/system" + file_getprop("/tmp/slotsel", "slotnum"), "0", "/system");
mount("ext4", "EMMC", file_getprop("/tmp/slotsel", "byname") + "/system" + file_getprop("/tmp/slotsel", "slotnum"), "/system");
package_extract_file("boot.img", file_getprop("/tmp/slotsel", "byname") + "/boot" + file_getprop("/tmp/slotsel", "slotnum")); set_progress(0.800000);

The goal is for by-name to be detected when flashing and not be in the updater-script at all. Let me know how it goes :)

edit: Updated download link, I made a typo in the last one.

Could you explain how you got it working for others? Thanks :)

This may be above my pay grade lol. In this case, all the capabilities are in capability.h and are not custom :confused:

edit: It seems the capabilities are coming from this file:

https://android.googlesource.com/pl...clude/private/android_filesystem_capability.h

and the permissions are coming from this one:

https://android.googlesource.com/pl...3/include/private/android_filesystem_config.h

Will this work for every device out there?
[SuperR Kitchen] bigrammy:
Thanks SuperR that was quick. :angel:

I will test this tomorrow evening after work. :highfive:
[SuperR Kitchen] osm0sis:
I'm guessing the files that [MENTION=1162986]Captain_Throwback[/MENTION] was saying aren't getting set correctly don't fall under any of the included rules? Those headers just need to be updated for them.

Here's an example of me adding some to fsconfig to support Motorola ramdisks with my updated mkbootfs: https://github.com/osm0sis/mkbootfs/commit/77dff554ce108cd77ba270d0cdff5e249169eada

Re-Edit: [MENTION=5787964]SuperR.[/MENTION] I just reread and the rules are all contained in fs config .h, eg. in my example commit above the 0s are for the capabilities apparently, so presumably you could add custom cap values that way as well. Pretty straightforward. :good:
[SuperR Kitchen] Captain_Throwback:
Found a bit more information on this: https://source.android.com/devices/tech/config/filesystem.html

That explains how an OEM would include custom rules within the build system. It should be possible to add the custom rules and build a new make_ext4fs binary that includes them, [MENTION=5787964]SuperR.[/MENTION], as [MENTION=4544860]osm0sis[/MENTION] indicated.
[SuperR Kitchen] tanish2k09:
Thanks!! This post was helpful, so I think I will point it to them if anyone from my forum ever happens to get confused in the nougat and MM by-name changes...

//Meanwhile, [MENTION=5787964]SuperR.[/MENTION] Did you check my pm??
[SuperR Kitchen] phpbb3:
I was missing a few dependencies upon installation, including getcap, setcap, lz4, and lzop. I installed lz4 and lzop fine, and installed libcap-progs libcap-ng0 libcap1 libcap2 to get setcap and getcap. While setcap and getcap work from the terminal for me as long as I use root, the kitchen still tells me that setcap and getcap are missing... Does anyone know what I'm doing wrong? I'm using openSUSE Tumbleweed x86.

Edit: I also tried running the kitchen as root (thinking maybe it needed root to see the tools were installed) but the kitchen won't run as root.
[SuperR Kitchen] manuelmagix:
I don't install SuperR's Kitchen:

Password for 'https://manuelmagix@gitlab.com':

remote: Counting objects: 1049, done.

remote: Compressing objects: 100% (516/516), done.

fatal: The remote end hung up unexpectedlyMiB | 29.00 KiB/s

fatal: early EOF

fatal: index-pack failed

manuelmagix@manuelmagix-X55CR ~ $
[SuperR Kitchen] russel5:
First i install all selinux packages like

selinux selinux-basics selinux-utils semanage-utils setools

After that - reboot. First reboot was tooo long, because selinux relabeled all system's context. That's all.
[SuperR Kitchen] SuperR.:
As mentioned before, this is not my area of expertise. Is there an easier way to figure out the source files needed to compile a single binary from AOSP? I have been reading all mk files and finding the dependencies manually and it is very time consuming. Seems like there must be a better way lol. I ask because I have not isolated the make_ext4fs source from nougat yet and would like to do so but don't have the time I once had. Thanks for your help :)

I am happy to do this, but I need to do what I mentioned above first or I won't be able to include the source in the kitchen. The new binary I compiled and linked for you earlier was compiled from the full AOSP source tree.

I did not get a PM

I have no clue about openSUSE. I only test on Ubuntu 16.04 for now.

Try logging into Gitlab in your web browser, then try to clone again.
[SuperR Kitchen] Captain_Throwback:
Yeah, I use the full Omni tree to build, personally, since I also use that tree for my TWRP builds. I have no expertise in separating out the source either, so hopefully [MENTION=4544860]osm0sis[/MENTION] can be of assistance there.

I can try adding those rules and building out an updated make_ext4fs binary, but I'll need some direction on what to put where and the build commands to use.
[SuperR Kitchen] osm0sis:
It can be pretty nasty to try and isolate utilities from the source tree, but it should be doable for anything that doesn't require network/usb access. I've got too many other things on my plate currently to do it myself, but if you could try to use the commits from my isolated zipalign and aapt repos as a template I'll help you wherever I can.

As for what new rules to add to libcutils/fsconfig.c, you need to narrow down exactly what files are missing capabilities/permissions/ownership. Perhaps comparing with getcap -r and ls -alR on-device with a working system, and then again with a broken one post-kitchen rebuild.
[SuperR Kitchen] Er. Aditya:
I am continuously getting status 6 error , might be some wrong space o something

here's the log if that's helpful

http://www12.zippyshare.com/v/dA35mVe2/file.html
[SuperR Kitchen] InterestingTwist:
[MENTION=5787964]SuperR.[/MENTION]

Slight logic error in your script. This line (#2441) :

elif [[ $api -eq 23 && $androidversion = "N" ]] || [[ $api -ge 24 ]]; then

Nougat is API 24 and greater so checking for API 23 and Nougat is pointless.
[SuperR Kitchen] Captain_Throwback:
For now, I just added the additional configs to /system/core/libcutils/fs_config.c and built a new make_ext4fs, replacing the one in the Kitchen tools folder, and now when using sparse_dat, the capabilities are being set correctly for these "custom" files. Thanks for your help, [MENTION=5787964]SuperR.[/MENTION] (and you too [MENTION=4544860]osm0sis[/MENTION])!

I know that's not a long-term solution though, as you'd prefer to have the kitchen build the binary. But this works for me in the short term. My updated binary is attached to the post, in case you want to look at it. The code I added is below:

/* The following files have enhanced capabilities and are for Advanced Calling features. */
{ 00755, AID_SYSTEM, AID_RADIO, CAP_MASK_LONG(CAP_NET_BIND_SERVICE), "system/bin/ims_rtp_daemon" },
{ 00755, AID_SYSTEM, AID_SYSTEM, CAP_MASK_LONG(CAP_NET_BIND_SERVICE), "system/bin/imsdatadaemon" },
{ 00755, AID_SYSTEM, AID_SYSTEM, CAP_MASK_LONG(CAP_NET_BIND_SERVICE), "system/bin/pm-service" },
{ 00755, AID_BLUETOOTH, AID_BLUETOOTH, CAP_MASK_LONG(CAP_BLOCK_SUSPEND), "system/bin/wcnss_filter" },

I also pulled in the latest inclusions from the master branch, as they added a few more files with capability entries. I don't know if my device has any of the additional files, but I figured including them wouldn't hurt anything.

htc_pmewl:/ # getcap -r /system
/system/bin/hostapd = cap_net_admin,cap_net_raw+ep
/system/bin/ims_rtp_daemon = cap_net_bind_service+ep
/system/bin/imsdatadaemon = cap_net_bind_service+ep
/system/bin/logd = cap_setgid,cap_audit_control,cap_syslog+ep
/system/bin/pm-service = cap_net_bind_service+ep
/system/bin/run-as = cap_setgid,cap_setuid+ep
/system/bin/surfaceflinger = cap_sys_nice+ep
/system/bin/wcnss_filter = cap_block_suspend+ep
htc_pmewl:/ #
[SuperR Kitchen] SuperR.:
I deleted your user and added it back. If that did not fix it either Gitlab is having an issue I can't fix or you are doing something wrong. Good luck :)

I am working on the source now. Thanks for the help, I may take you up on it if I get stuck :)

According to the log, it is trying to mount /dev/block/platform/13540000.dwmmc0/by-name/system. Is that the correct by-name for your device? Is the partition ext4? Is that while using the experiment script I posted? If so, it seems to have done it's job getting by-name correct. This is the same problem you had without the experiment script. Not sure what the problem is.

Not true. Nougat preview is api 23 and the version number is N :)
[SuperR Kitchen] bcrichster:
A dependency has changed names apparently.. Don't remember what it used to be called but in order to repo init or git pull I had to install android-phablet-tools to get stuff to pull. I'm running Mint 17.3 (Ubuntu 14 based)

Sent from my N9515 PAC-ROM
[SuperR Kitchen] IZI.Xav:
Hi [MENTION=535343]all[/MENTION], [MENTION=718594]super[/MENTION]r I use your kitchen from the beginning is that good I have to say.

Now since I can no longer boot my phone with set_metada especially since I have a config folder with inside the file "slotdetect.sh"

I must say that I do not know what it serves but since it appears more possible to flasher I always block in the recovery.

I am on Samsung S6 edge + 6.0.1 marshmallow I attach my update script as well as the config file if someone has an idea ...

Sorry for my bad English !

Thank you

update-script+config

Edit: I just changed to raw_img the flash happens without worries, but when I restart I'm still on the rom I had before the flash ??
[SuperR Kitchen] bigrammy:
Hi SuperR,

Some feedback:

Using the recovery.fstab is unfortunately not a reliable method due to many variables. Most TWRP's use twrp.fastab and most CWM based recovery's use fstab.mt6xxx with the recovery.fstab been unused and often has false info.

I suspect in [MENTION=5750672]Er. Aditya[/MENTION] case he is using a ported recovery which is giving the incorrect paths for His device and is giving info of the port device. :confused:

sgdisk --print /dev/block/mmcblk0

(MediaTek maybe others)

Seems the most reliable way to set things up.

Rushing this post as I am late for work :eek:
[SuperR Kitchen] SuperR.:
I am not sure I understand, but I modified your files if you want to test something out. Replace them in the existing rom zip. Let me know how it goes. If it fails, please send a recovery.log after flashing.

https://www.androidfilehost.com/?fid=673368273298924414

Please give this one a try. It does not use sgdisk as I am not certain it exists on all devices. Instead it cycles through /etc/twrp.fstab, /etc/fstab.*, /etc/*.fstab in that order. It stops when it finds by-name which will likely be before it gets to recovery.fstab.

https://www.androidfilehost.com/?fid=745425885120701075

FYI, you will need to add the slotdetect.sh file to the zip after it is built or manually zip the rom after adding it. The kitchen will revert to the default one before building so make sure the new one is in the zip before flashing.

Let me know how it goes :)
[SuperR Kitchen] IZI.Xav:
Thanks SuperR. I test and come back.
[SuperR Kitchen] moluntic:
hey guys,can anybody send me the cloned package of kitchen?? i mean zip file. i cant download it from bitbucket

thanks