Skip to content

Block running ADBD as root and remove some restrictions built in the "run-as" utility#22

Closed
ChrysoliteAzalea wants to merge 1 commit intowaydroid:lineage-18.1from
ChrysoliteAzalea:runas_adbd
Closed

Block running ADBD as root and remove some restrictions built in the "run-as" utility#22
ChrysoliteAzalea wants to merge 1 commit intowaydroid:lineage-18.1from
ChrysoliteAzalea:runas_adbd

Conversation

@ChrysoliteAzalea
Copy link
Copy Markdown
Contributor

Hello everyone! I propose patching ADBD to unconditionally block restarting as root, and run-as to remove some restrictions.

The reason for unconditionally blocking restarting ADBD as root is that it allows an unprivileged user to enable the "Rooted debugging" option and use the adb root command in order to get root shell (and it runs as an actual root UID since the container is privileged, however, it's restricted due to security options enabled in LXC container config), and there is no way for the administrator to prevent that. Privileged things that require root can be done with the waydroid shell subcommand (or with Magisk) that require either root, or initial privileged setup.

Removing restrictions in the run-as utility by patching the utility itself is also a far cleaner way to enhance its usefulness than tampering with the package list, and is less likely to introduce problems.

@aleasto
Copy link
Copy Markdown
Member

aleasto commented Jul 26, 2023

Please split the two patches

@aleasto
Copy link
Copy Markdown
Member

aleasto commented Jul 26, 2023

Also force this to return true for added proteciton against manually setting service.adb.root
Even if it temporarily needs root access to be set, subsequent unprivileged users would retain the root access.

@ChrysoliteAzalea
Copy link
Copy Markdown
Contributor Author

OK, done -- closing this in favor of #23 and #24

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants