News for hackers. Stuff that matters.

A comment on Show HN: Android 'root' phones via dirtyc0w exploit. Parent comment

Re:Show HN: Android 'root' phones via dirtyc0w exploit by daveloyall on Thursday October 27, 2016 @02:55PM (#12808351)
Are you saying that on Android, you can achieve UID=0 via this exploit, but still not write to anywhere important on the device?

What are these different "methods" listed in the table here?

https://github.com/dirtycow/dirtycow.github.io/wiki/PoCs

Can one of those methods allow me to write to some file in /etc? (Which is enough to grant me the access I want, unless selinux is just MAGIC.)

[ Parent | on HN ]
Re:Show HN: Android 'root' phones via dirtyc0w exploit by therein on Saturday October 29, 2016 @06:23PM (#12826782)
SELinux can still prevent you (even if you are `$UID=0`) from performing an operation such as writing to a file under `/etc`.

You would need to be able to `setenforce 0 `. A properly configured SELinux context can prevent you from doing that however we are starting to finally see some reports of dirtyc0w successfuly leading to `SELinux status: permissive` and permanent root.

[ Parent | on HN ]