MTK 6765/6739/6755/6761/6763 android9.0 user版本打开root权限(adb root权限和 apk root权限)

前言

相比较 Android8.1 而言，9.0 的 root变得更麻烦了，因为 9.0 开始 google 启用 avb(Android Verified Boot)2.0，安全等级又提高了，可看这篇Android P(9.0) userdebug 版本执行adb remount失败,就连直接编译 userdebug、eng版本都不能直接 push 了，解决办法就是得 fastboot 解锁，然后关闭 verity 方能 adb remount 成功。我尝试和 8.1 一样增加开机启动脚本但并未生效，在这耗费了很长时间，就暂时先跳过吧，解锁是目前来看可靠可行的方案，如果你有更好的方法欢迎留言讨论。

一图胜千言

修改方案

上面的图就不用我多说了吧，分别用了 ROOT检测工具、RE文件管理器测试，只要 root 成功都有明显的提示，

也可以用 AirDroid 来远程控制测试是否成功 root。

总共修改 11 个文件，新增 3 个文件，一共 14 个

	modified:    build/make/core/main.mk
	modified:     device/mediatek/sepolicy/basic/non_plat/file_contexts
	modified:     device/mediateksample/k62v1_64_bsp/device.mk
	modified:     system/core/adb/Android.mk
	modified:     system/core/init/selinux.cpp
	modified:     system/core/libcutils/fs_config.cpp
	modified:     system/core/rootdir/init.rc
	modified:     vendor/mediatek/proprietary/bootable/bootloader/lk/app/mt_boot/sec_unlock.c
	modified:     vendor/mediatek/proprietary/bootable/bootloader/lk/platform/common/boot/vboot_state.c
	modified:     vendor/mediatek/proprietary/bootable/bootloader/preloader/custom/k62v1_64_bsp/k62v1_64_bsp.mk
	modified:     vendor/mediatek/proprietary/hardware/fstab/mt6765/fstab.in.mt6765

	
	add device/mediatek/sepolicy/basic/non_plat/suproce.te
	add system/extras/su/su
	add system/extras/su/suproce.sh

1、让进程名称在 AS Logcat 中可见，通过修改 ro.adb.secure 和 ro.secure

ps：这步不是必须的，目的只是在 logcat 中可见进程 pid 和包名，而且打开 USB 调试时默认授权，不再弹授权框

build/make/core/main.mk

 tags_to_install :=
 ifneq (,$(user_variant))
   # Target is secure in user builds.
-  ADDITIONAL_DEFAULT_PROPERTIES += ro.secure=1
+  # ADDITIONAL_DEFAULT_PROPERTIES += ro.secure=1
+  ADDITIONAL_DEFAULT_PROPERTIES += ro.secure=0
   ADDITIONAL_DEFAULT_PROPERTIES += security.perf_harden=1
 
   ifeq ($(user_variant),user)
-    ADDITIONAL_DEFAULT_PROPERTIES += ro.adb.secure=1
+    # ADDITIONAL_DEFAULT_PROPERTIES += ro.adb.secure=1
+    ADDITIONAL_DEFAULT_PROPERTIES += ro.adb.secure=0
   endif
 
   ifeq ($(user_variant),userdebug)
@@ -251,7 +253,7 @@ ifneq (,$(user_variant))
     tags_to_install += debug
   else
     # Disable debugging in plain user builds.
-    enable_target_debugging :=
+    # enable_target_debugging :=
   endif
 
   # Disallow mock locations by default for user builds

2、修改 SELinux权限为 Permissive

SELinux 常用状态有两个 Permissive 和 Enforcing，通过 adb shell getenforce 可查看当前所处模式
9.0 改到了 selinux.cpp 中

system/core/init/selinux.cpp

 bool IsEnforcing() {
+    return false;
     if (ALLOW_PERMISSIVE_SELINUX) {
         return StatusFromCmdline() == SELINUX_ENFORCING;
     }

3、修改 system 分区权限为可读写

Dear customer,开启完整的root 权限需要开通SELinux 权限，这部分修改无法通过CTS 测试。

我司目前不会提供类似的方案给贵司。目前我们只支持USB adb权限。这是 MTK 的官方回复。

vendor/mediatek/proprietary/hardware/fstab/mt6765/fstab.in.mt6765

 #endif
 
 
-DEVPATH(system)     SYS_MOUNT_POINT      __MTK_SYSIMG_FSTYPE ro  FSMGR_FLAG_SYSTEM
+DEVPATH(system)     SYS_MOUNT_POINT      __MTK_SYSIMG_FSTYPE rw  FSMGR_FLAG_SYSTEM
 #ifdef __VENDOR_PARTITION_SUPPORT
-DEVPATH(vendor)     /vendor              __MTK_VNDIMG_FSTYPE ro  FSMGR_FLAG_SYSTEM
+DEVPATH(vendor)     /vendor              __MTK_VNDIMG_FSTYPE rw  FSMGR_FLAG_SYSTEM
 #endif
 #ifdef __ODM_PARTITION_SUPPORT
-DEVPATH(odm)        /odm                 __MTK_ODMIMG_FSTYPE ro  FSMGR_FLAG_SYSTEM
+DEVPATH(odm)        /odm                 __MTK_ODMIMG_FSTYPE rw  FSMGR_FLAG_SYSTEM
 #endif
 DEVPATH(userdata)   /data        __MTK_DATAIMG_FSTYPE   FS_FLAG_DATA  FSMGR_FLAG_DATA

4、关闭 DM-verity，确保 system 分区真正可读写

vendor/mediatek/proprietary/bootable/bootloader/preloader/custom/k62v1_64_bsp/k62v1_64_bsp.mk

 TARGET=k62v1_64_bsp
 MTK_PLATFORM=MT6765
 MTK_SEC_CHIP_SUPPORT=yes
-MTK_SEC_USBDL=ATTR_SUSBDL_ONLY_ENABLE_ON_SCHIP
-MTK_SEC_BOOT=ATTR_SBOOT_ENABLE
+MTK_SEC_USBDL=ATTR_SUSBDL_DISABLE
+MTK_SEC_BOOT=ATTR_SBOOT_DISABLE
 MTK_SEC_MODEM_AUTH=no
 MTK_SEC_SECRO_AC_SUPPORT=yes
 # Platform

5、增加 su 相关，确保 apk root 权限

apk 获取 root 权限，需要内置 su 文件，参考之前 8.1 的做法，在 init.rc 中 boot_completed 时执行脚本

开机执行脚本的命令可直接加在 system/core/rootdir/init.rc

开机脚本执行是否成功，可通过 adb shell dmesg > dmesg.txt 抓取 init 的日志，搜索是否报错，或者缺少权限。
ps: 这步我目前并未执行成功，但没有影响 su 的使用

boot_completed 启动完成时，start suproce

system/core/rootdir/init.rc

     class_reset main
 
+service suproce /system/bin/sh /system/bin/suproce.sh
+    class main
+    user root
+    group root
+    oneshot
+    seclabel u:object_r:suproce_exec:s0
+
+
 on property:sys.boot_completed=1
+    start suproce
     bootchart stop

system/extras/su/suproce.sh

#!/system/bin/sh


mount -o rw,remount /system
chmod 06755 su
su --daemon

echo "su daemon done."

此处写法有变动，不能加 vendor，因为在 system\sepolicy\public\domain.te 中 1015 行进行了权限检查，编译时报错，这个问题也是困扰了好几天，各种尝试后将 file_contexts 中的 vendor 配置去掉编译通过了。

#line 5
libsepol.report_failure: neverallow on line 1015 of system/sepolicy/public/domain.te (or line 11403 of policy.conf) violated by allow suproce suproce_exec:file { execute };
libsepol.check_assertions: 1 neverallow failures occurred
Error while expanding policy
out/host/linux-x86/bin/checkpolicy:  loading policy configuration from out/target/product/k62v1_64_bsp/obj/ETC/sepolicy_neverallows_intermediates/policy.conf
[  0% 48/41921] ATF build: out/target/product/k62v1_64_bsp/trustzone/ATF_OBJ/debug/bl31.bin

device/mediatek/sepolicy/basic/non_plat/file_contexts

 #hidl process merging
 /(system\/vendor|vendor)/bin/hw/merged_hal_service          u:object_r:merged_hal_service_exec:s0
+
+#suproce
+#/(system\/vendor|vendor)/bin/suproce.sh          u:object_r:suproce_exec:s0
+/system/bin/suproce.sh          u:object_r:suproce_exec:s0

device/mediatek/sepolicy/basic/non_plat/suproce.te

type suproce, coredomain;
 
type suproce_exec, exec_type, vendor_file_type, file_type;
 
# permissive suproce;
# allow shell suproce_exec:file { read open getattr execute };
 
init_daemon_domain(suproce);

拷贝 su 文件和开机脚本 suproce.sh 到 system/bin 目录下
device/mediateksample/k62v1_64_bsp/device.mk

@@ -19,6 +19,11 @@ PRODUCT_COPY_FILES += $(LOCAL_PATH)/sbk-kpd.kl:system/usr/keylayout/sbk-kpd.kl:m
                       $(LOCAL_PATH)/sbk-kpd.kcm:system/usr/keychars/sbk-kpd.kcm:mtk
 endif
 
+PRODUCT_COPY_FILES += \
+       system/extras/su/su:system/bin/su \
+       system/extras/su/suproce.sh:system/bin/suproce.sh
+

给 su 文件增加权限

system/core/libcutils/fs_config.cpp

@@ -166,7 +168,9 @@ static const struct fs_path_config android_files[] = {
     // the following two files are INTENTIONALLY set-uid, but they
     // are NOT included on user builds.
     { 06755, AID_ROOT,      AID_ROOT,      0, "system/xbin/procmem" },
-    { 04750, AID_ROOT,      AID_SHELL,     0, "system/xbin/su" },
+    { 06755, AID_ROOT,      AID_SHELL,     0, "system/bin/su" },
+    { 06755, AID_ROOT,      AID_SHELL,     0, "system/xbin/su" },
+    //{ 04750, AID_ROOT,      AID_SHELL,     0, "system/xbin/su" },
 
     // the following files have enhanced capabilities and ARE included
     // in user builds.

6、修改 adb root 权限(需要解锁 fastboot，并关闭 verity) 按需操作

system/core/adb/Android.mk

@@ -351,9 +351,9 @@ LOCAL_CFLAGS := \
     -D_GNU_SOURCE \
     -Wno-deprecated-declarations \
 
-LOCAL_CFLAGS += -DALLOW_ADBD_NO_AUTH=$(if $(filter userdebug eng,$(TARGET_BUILD_VARIANT)),1,0)
+LOCAL_CFLAGS += -DALLOW_ADBD_NO_AUTH=$(if $(filter user userdebug eng,$(TARGET_BUILD_VARIANT)),1,0)
 
-ifneq (,$(filter userdebug eng,$(TARGET_BUILD_VARIANT)))
+ifneq (,$(filter user userdebug eng,$(TARGET_BUILD_VARIANT)))
 LOCAL_CFLAGS += -DALLOW_ADBD_DISABLE_VERITY=1
 LOCAL_CFLAGS += -DALLOW_ADBD_ROOT=1
 endif

解锁时可能音量上键不生效，那需要进行对调

vendor/mediatek/proprietary/bootable/bootloader/lk/app/mt_boot/sec_unlock.c

        unlock_warranty();
 
        while (1) {
-               if (mtk_detect_key(MT65XX_MENU_SELECT_KEY)) { //VOL_UP
+               //if (mtk_detect_key(MT65XX_MENU_SELECT_KEY)) { //VOL_UP
+               if (mtk_detect_key(MT65XX_MENU_OK_KEY)) { //VOL_DOWN
                        fastboot_info("Start unlock flow\n");
                        //Invoke security check after confirming "yes" by user
                        ret = fastboot_get_unlock_perm(&unlock_allowed);
@@ -374,7 +375,8 @@ void fastboot_oem_unlock(const char *arg, void *data, unsigned sz)
                                fastboot_okay("");
                        }
                        break;
-               } else if (mtk_detect_key(MT65XX_MENU_OK_KEY)) { //VOL_DOWN
+               //} else if (mtk_detect_key(MT65XX_MENU_OK_KEY)) { //VOL_DOWN
+               } else if (mtk_detect_key(MT65XX_MENU_SELECT_KEY)) { //VOL_UP
                        video_printf("return to fastboot in 3s\n");
                        mdelay(3000);
                        fastboot_boot_menu();

去除 oem 解锁后每次开机提示 Your device has been unlocked and can’t be trusted 警告字眼

vendor/mediatek/proprietary/bootable/bootloader/lk/platform/common/boot/vboot_state.c

@@ -133,9 +133,10 @@ int orange_state_warning(void)
 
        video_clean_screen();
        video_set_cursor(video_get_rows() / 2, 0);
-       video_printf(title_msg);
-       video_printf("Your device has been unlocked and can't be trusted\n");
-       video_printf("Your device will boot in 5 seconds\n");
+       //20191206  annotaion 
+       // video_printf(title_msg);
+       // video_printf("Your device has been unlocked and can't be trusted\n");
+       // video_printf("Your device will boot in 5 seconds\n");
        mtk_wdt_restart();
        mdelay(5000);
        mtk_wdt_restart();

编译成功重新烧写，按照 解锁方法

获取 adb root 权限。

C:>adb root

C:>adb remount
remount of the / superblock failed: Permission denied
remount failed

C:>adb disable-verity
Device is locked. Please unlock the device first

C:>adb reboot bootloader

C:>fastboot flashing unlock
…
(bootloader) Start unlock flow

OKAY [ 12.394s]
finished. total time: 12.398s

C:>fastboot reboot
rebooting…

finished. total time: 0.003s

C:>adb root

C:>adb disable-verity
Successfully disabled verity
Now reboot your device for settings to take effect

C:>adb reboot

C:>adb root

C:>adb remount
remount succeeded

C:>

好了，终于大功告成，一时 root 一时爽，一直 root 一直爽。

su 和 apk下载

参考文章

Android开机启动shell脚本（Android 8.0测试OK）
为 Android 8.0 添加开机启动脚本
Android系统init进程启动及init.rc全解析
android文件系统挂载分析(1)—正常开机挂载
Android 8.1 启动篇（一） – 深入研究 init
SEAndroid
ANDROID权限说明 SYSTEM权限 ROOT权限
Android编译版本eng、user和userdebug的区别
Android模拟器获取Root权限
MTK android8.1添加root权限
MTK Android user版本如何打开root权限