[ASUS ZenFone 8] bnsmb:
Magisk uses the table policies in the Magisk database /data/adb/magisk.db to store the list of root enabled apps.

This Howto is about how to change the entries in that table via script.

Caution:

Changing the table via script is necessary for the automatic installation and configuration of the Android OS. Of course you can do a lot of mischief with it and bypass the security checks of Android and Magisk i.e. this should only be used with caution!

On the other hand, who rooted her phone via Magisk should know what she is doing anyway ....

Anyway -- let's start:

Note:

Most of the commands in this HowTo must be done by the user root.

magisk.db is a sqlite database so to list the table sqlite3 can be used, e.g.:

ASUS_I006D:/ # /data/adb/sqlite3 /data/adb/magisk.db 'select * from policies ;'
2000|2|0|1|1
10143|2|0|1|1
10134|2|0|1|1
10141|2|0|1|1
ASUS_I006D:/ #

or in a human readable format:

ASUS_I006D:/ # /data/adb/sqlite3 -table /data/adb/magisk.db 'select * from policies ;'
+-------+--------+-------+---------+--------------+
| uid | policy | until | logging | notification |
+-------+--------+-------+---------+--------------+
| 2000 | 2 | 0 | 1 | 1 |
| 10143 | 2 | 0 | 1 | 1 |
| 10134 | 2 | 0 | 1 | 1 |
| 10141 | 2 | 0 | 1 | 1 |
+-------+--------+-------+---------+--------------+
ASUS_I006D:/ #

Not all sqlite3 binaries support the parameter -table : for sqlite binaries not supporting the parameter -table the parameter -column -header can be used for a human readble output, e.g.:

ASUS_I006D:/ # /data/adb/sqlite3 -column -header /data/adb/magisk.db "select * from policies ;"
uid policy until logging notification
----- ------ ----- ------- ------------
2000 2 0 1 1
10134 2 0 1 1
10141 2 0 1 1
10143 2 0 1 1
10129 2 0 1 1
10122 2 0 1 1
10133 3 0 1 1
ASUS_I006D:/ #

sqlite3 is not part of the Android OS; it must be installed either by copying the sqlite3 binary to the phone (see also this thread : https://xdaforums.com/t/new-sqlite3-binary-v3-40-0-for-all-devices.4273049/ ) or by installing a Magisk module with sqlite like for example this one: https://github.com/stylemessiah/SQLite3UniversalBinaries

Fortunately the binary magisk from Magisk can also work with SQL databases. So the entries of the table policies can also be printed using the magisk binary, e.g:

ASUS_I006D:/ # magisk --sqlite 'select * from policies ;'
logging=1|notification=1|policy=2|uid=2000|until=0
logging=1|notification=1|policy=2|uid=10143|until=0
logging=1|notification=1|policy=2|uid=10134|until=0
logging=1|notification=1|policy=2|uid=10141|until=0
ASUS_I006D:/ #

To add another entry to the table policies either sqlite3 or magisk can be used, example:

ASUS_I006D:/ # /data/adb/sqlite3 -table /data/adb/magisk.db 'select * from policies ;'
+-------+--------+-------+---------+--------------+
| uid | policy | until | logging | notification |
+-------+--------+-------+---------+--------------+
| 2000 | 2 | 0 | 1 | 1 |
| 10143 | 2 | 0 | 1 | 1 |
| 10134 | 2 | 0 | 1 | 1 |
| 10141 | 2 | 0 | 1 | 1 |
+-------+--------+-------+---------+--------------+
ASUS_I006D:/ #

-> insert an entry for the UID 10888 in the table policies using magisk :

ASUS_I006D:/ # magisk --sqlite 'INSERT INTO policies (uid,policy,until,logging,notification) values(10888,2,0,1,1);'
ASUS_I006D:/ #

ASUS_I006D:/ # /data/adb/sqlite3 -table /data/adb/magisk.db 'select * from policies ;'
+-------+--------+-------+---------+--------------+
| uid | policy | until | logging | notification |
+-------+--------+-------+---------+--------------+
| 2000 | 2 | 0 | 1 | 1 |
| 10143 | 2 | 0 | 1 | 1 |
| 10134 | 2 | 0 | 1 | 1 |
| 10141 | 2 | 0 | 1 | 1 |
| 10888 | 2 | 0 | 1 | 1 |
+-------+--------+-------+---------+--------------+
ASUS_I006D:/ #

-> insert an entry for the UID 10999 in the table policies using sqlite3 :

ASUS_I006D:/ # /data/adb/sqlite3 -table /data/adb/magisk.db 'INSERT INTO policies (uid,policy,until,logging,notification) values(10999,2,0,1,1);'
ASUS_I006D:/ #

ASUS_I006D:/ # /data/adb/sqlite3 -table /data/adb/magisk.db 'select * from policies ;'
+-------+--------+-------+---------+--------------+
| uid | policy | until | logging | notification |
+-------+--------+-------+---------+--------------+
| 2000 | 2 | 0 | 1 | 1 |
| 10143 | 2 | 0 | 1 | 1 |
| 10134 | 2 | 0 | 1 | 1 |
| 10141 | 2 | 0 | 1 | 1 |
| 10888 | 2 | 0 | 1 | 1 |
| 10999 | 2 | 0 | 1 | 1 |
+-------+--------+-------+---------+--------------+
ASUS_I006D:/ #

To change an existing entry use the SQL command REPLACE, e.g.

#
# using the magisk binary to change the entry for the UID 10888
#
magisk --sqlite 'REPLACE INTO policies (uid,policy,until,logging,notification) values(10888,2,0,1,1);'

#
# using the sqlite3 binary to change the entry for the UID 10999
#
/data/adb/sqlite3 -table /data/adb/magisk.db 'REPLACE INTO policies (uid,policy,until,logging,notification) values(10999,2,0,1,1);'

To delete an entry use the SQL command DELETE, e.g.:

#
# use magisk to delete the entry for the UID 10999
#
magisk --sqlite 'DELETE FROM policies where (uid=10999) ; '

#
# use sqlite3 to delete the entry for the UID 10888
#
/data/adb/sqlite3 -table /data/adb/magisk.db 'DELETE FROM policies where (uid=10888);'

The uid in the table policies is the UID from the packages installed on the phone.

To get the list of installed packages with UIDs use this command:

pm list packages -U

example:

130|ASUS_I006D:/ # pm list packages -U
package:org.microg.nlp.backend.nominatim uid:10071
package:com.qualcomm.qti.gpudrivers.lahaina.api30 uid:10079
package:com.android.theme.icon.teardrop uid:10008
....
package:com.qualcomm.qtil.aptxacu uid:10110
package:com.android.pacprocessor uid:10062
package:com.android.messaging uid:10091
package:com.android.theme.icon.square uid:10007
ASUS_I006D:/ #

To get the UID for a specific package use

pm list packages -U "<appname>"

example:

ASUS_I006D:/ # pm list packages -U com.android.shell | cut -f3 -d ":"
2000
ASUS_I006D:/ #

The value for policy in the table policies defines the root access status for an app: the value for root enabled is 2. So to list the UIDs of all apps with enabled root access use this command:

ASUS_I006D:/ # magisk --sqlite "SELECT uid FROM policies WHERE policy = '2';"
uid=2000
uid=10143
uid=10134
uid=10141
ASUS_I006D:/ #

... or use the handy little script from this thread https://xdaforums.com/t/magisk-general-support-discussion.3432382/page-2681:

ASUS_I006D:/ # sh /sdcard/Download/list_magisk_root_permissions.sh
Packages with root granted:
package:com.android.shell uid:2000
package:com.mixplorer uid:10143
package:com.keramidas.TitaniumBackup uid:10134
package:io.github.muntashirakon.AppManager uid:10141
ASUS_I006D:/ #

Note:

The value for policy in the table policies for apps with disabled root access is 1.

Scripts

To automate enabling root access by changing the entries in the Magisk database I wrote a little script:

enable_root_access_via_magisk.sh

Usage:

ASUS_I006D:/ # /data/adb/enable_root_access_via_magisk.sh -h

enable_root_access_via_magisk.sh [-f] [-H|--help] [id1 ... id#]

1|ASUS_I006D:/ #

Verbose Usage:

Spoiler content hidden.

Example:

Spoiler content hidden.

enable_root_access_via_magisk.sh can run in the Android OS or in a adb shell in a running TWRP. If running in the Android OS the script needs an already enabled root access for the shell so it can not be used that way to configure the initial root access for the shell.

Therefor I wrote another script to automate enabling the root access for the shell after the initial installation:

init_magisk_db.sh

init_magisk_db.sh boots the phone from the TWRP image, copies the script enable_root_access_via_magisk.sh to the phone, and executes enable_root_access_via_magisk.sh then on the phone to enable the initial root access.

This is useful to automatically configure a root enabled shell that then can be used in other scripts to complete the installation and configuration of the phone.

Usage:

[xtrnaw7@t15g /data/develop/android/scripts_on_linux]$ ./init_magisk_db.sh -h
init_magisk_db.sh version - v1.0.0.0 - shell script to enable root access via Magisk for specified apps

init_magisk_db.sh [-h|help|-H] [--list|-l] [--force|-f] [--reboot|--noreboot] [apps=app1,..,app#]

[xtrnaw7@t15g /data/develop/android/scripts_on_linux]$

Verbose usage

Spoiler content hidden.

Spoiler content hidden.

Notes:

init_magisk_db.sh needs a working adb access to the phone.

If one or more of the values for the parameter apps= for init_magisk_db.sh are app names init_magisk_db.sh will first boot the phone into the Android OS (if not already booted into the Android OS) to retrieve the UIDs for these apps (for this task no root access is necessarry).

init_magisk_db.sh uses the script boot_phone_from_twrp.sh for booting the phone into the TWRP image (the script is also attached to this post)

This method can also be used to give apps root rights that they do not require ... whether this is useful everyone must decide for themselves.

All three scripts mentioned in this post are also available on my home page:

boot_phone_from_twrp.sh

enable_root_access_via_magisk.sh

init_magisk_db.sh

Note that the Magisk App will silently remove all invalid entries from the table policies in the Magisk database; dito for entries for non-existent UIDs .

Update 07.12.2022 /bs

see How to boot a phone from a TWRP recovery image via script for details about the script boot_phone_from_twrp.sh.