Re:Show HN: Android 'root' phones via dirtyc0w exploit
by omribahumi on Thursday October 27, 2016 @01:56AM
(#12803186)
Maybe I'm missing something here, but what stops you from putting a setuid "su" binary and keeping the root access, even if the kernel is upgraded?
[ Parent
| on HN ]
Re:Show HN: Android 'root' phones via dirtyc0w exploit
by therein on Thursday October 27, 2016 @03:12AM
(#12803395)
You're root running in a limited selinux context.
Re:Show HN: Android 'root' phones via dirtyc0w exploit
by omribahumi on Thursday October 27, 2016 @07:11AM
(#12804151)
I'm assuming that's because of the Android security model, rather than a limitation of the exploit itself?
edit: Apparently SETUID is disabled on Android:
... using kernel features that help block privilege escalation (e.g. NOSUID, NO_NEW_PRIVS).
Re:Show HN: Android 'root' phones via dirtyc0w exploit
by daveloyall on Thursday October 27, 2016 @02:55PM
(#12808351)
Are you saying that on Android, you can achieve UID=0 via this exploit, but still not write to anywhere important on the device?
What are these different "methods" listed in the table here?
https://github.com/dirtycow/dirtycow.github.io/wiki/PoCs
Can one of those methods allow me to write to some file in /etc? (Which is enough to grant me the access I want, unless selinux is just MAGIC.)
Re:Show HN: Android 'root' phones via dirtyc0w exploit
by therein on Saturday October 29, 2016 @06:23PM
(#12826782)
SELinux can still prevent you (even if you are `$UID=0`) from performing an operation such as writing to a file under `/etc`.
You would need to be able to `setenforce 0 `. A properly configured SELinux context can prevent you from doing that however we are starting to finally see some reports of dirtyc0w successfuly leading to `SELinux status: permissive` and permanent root.