ADB ROOT开启流程

开启adb root 选项后,执行如下代码:

packages/apps/Settings/src/com/android/settings/development/AdbRootPreferenceController.java

java 复制代码
mADBRootService = new ADBRootService();   
 
 
@Override
public boolean onPreferenceChange(Preference preference, Object newValue) {
    final boolean rootEnabled = (Boolean) newValue;
    mADBRootService.setEnabled(rootEnabled);
    return true;
}
复制代码
ADBRootService类位于 frameworks/base/core/java/android/adb/ADBRootService.java
java 复制代码
public void setEnabled(boolean enable) {
    try {
        final IADBRootService svc = getService();
        if (svc != null) {
            svc.setEnabled(enable);
        }
    } catch (RemoteException e) {
        throw e.rethrowFromSystemServer();
    }
}

实际调用 IADBRootService 服务的 setEnabled

adb_root服务的入口函数位于 system/core/adb/root/main.cpp

cpp 复制代码
void ADBRootService::Register() {
    auto service = ndk::SharedRefBase::make<ADBRootService>();
    binder_status_t status = AServiceManager_addService(
            service->asBinder().get(), getServiceName());
 
 
    if (status != STATUS_OK) {
        LOG(FATAL) << "Could not register adbroot service: " << status;
    }
}
 
ndk::ScopedAStatus ADBRootService::setEnabled(bool enabled) {
    uid_t uid = AIBinder_getCallingUid();
    if (uid != AID_SYSTEM) {
        return SecurityException("Caller must be system");
    }
 
    AutoMutex _l(lock_);
 
    if (enabled_ != enabled) {
        enabled_ = enabled;
        WriteStringToFile(std::to_string(enabled), kStoragePath + kEnabled);
 
        // Turning off adb root, restart adbd.
        if (!enabled) {
            SetProperty("service.adb.root", "0");
            SetProperty("ctl.restart", "adbd");
        }
    }
 
    return ndk::ScopedAStatus::ok();
}

mian函数执行时,调用 Register 将native层的 ADBRootService 注册到名为 adbroot_service 的系统服务

执行 adb root命令时, 调用 restart_root_service

cpp 复制代码
void restart_root_service(unique_fd fd) {
    if (getuid() == 0) {
        WriteFdExactly(fd.get(), "adbd is already running as root\n");
        return;
    }
 
 
#if defined(__ANDROID__) && !defined(__ANDROID_RECOVERY__)
    ndk::SpAIBinder binder = ndk::SpAIBinder(AServiceManager_getService("adbroot_service"));
    std::shared_ptr<aidl::android::adbroot::IADBRootService> service =
            aidl::android::adbroot::IADBRootService::fromBinder(binder);
    if (!service) {
        LOG(ERROR) << "Failed to get adbroot_service interface";
        return;
    }
#endif
 
#if defined(__ANDROID__) && !defined(__ANDROID_RECOVERY__)
    bool enabled = false;
    if (auto status = service->getEnabled(&enabled); !status.isOk()) {
#endif
    if (!__android_log_is_debuggable()) {
        WriteFdExactly(fd.get(), "adbd cannot run as root in production builds\n");
        return;
    }
#if defined(__ANDROID__) && !defined(__ANDROID_RECOVERY__)
    }
    if (!enabled) {
        WriteFdExactly(fd, "ADB Root access is disabled by system setting - "
                "enable in Settings -> System -> Developer options\n");
        return;
    }
#endif
 
    LOG(INFO) << "adbd restarting as root";
    android::base::SetProperty("service.adb.root", "1");
    WriteFdExactly(fd.get(), "restarting adbd as root\n");
}

主要作用 设置属性 service.adb.root = 1

ADB ROOT必要条件分析

开发者选项: development_settings_enabled

adb调试:adb_enabled

上述字段通过 getString 获取

1、开发者选项中adb root是否显示取决于 ro.debuggable属性:

当 ro.debuggable = 0 时, 开发者选项界面不显示开启adb root 选项

2、adb始终以root权限运行

adb 服务被 init进程拉起时,是以root权限运行,拉起后会进行降权操作。

system/core/adb/daemon/main.cpp

cpp 复制代码
static bool should_drop_privileges() {
    // The properties that affect `adb root` and `adb unroot` are ro.secure and
    // ro.debuggable. In this context the names don't make the expected behavior
    // particularly obvious.
    //
    // ro.debuggable:
    //   Allowed to become root, but not necessarily the default. Set to 1 on
    //   eng and userdebug builds.
    //
    // ro.secure:
    //   Drop privileges by default. Set to 1 on userdebug and user builds.
    bool ro_secure = android::base::GetBoolProperty("ro.secure", true);
    bool ro_debuggable = __android_log_is_debuggable();
 
 
    // Drop privileges if ro.secure is set...
    bool drop = ro_secure;
 
    // ... except "adb root" lets you keep privileges in a debuggable build.
    std::string prop = android::base::GetProperty("service.adb.root", "");
    bool adb_root = (prop == "1");
    bool adb_unroot = (prop == "0");
    if (ro_debuggable && adb_root) {
        drop = false;
    }
    // ... and "adb unroot" lets you explicitly drop privileges.
    if (adb_unroot) {
        drop = true;
    }
 
    return false; //不降权,始终以root权限运行
}

当 service.adb.root 属性为 1 且 ro.debuggable = 1 时,会继续保持root权限运行

相关推荐
SH11HF6 小时前
小菜狗的云计算之旅,今天学习MySQL数据库基础知识及操作
adb
@Ryan Ding9 小时前
MySQL主从复制与读写分离概述
android·mysql·adb
feifeigo12315 小时前
升级到MySQL 8.4,MySQL启动报错:io_setup() failed with EAGAIN
数据库·mysql·adb
Edingbrugh.南空1 天前
Flink MySQL CDC 环境配置与验证
mysql·adb·flink
陈卓4101 天前
MySQL-主从复制&分库分表
android·mysql·adb
ladymorgana1 天前
【docker】修改 MySQL 密码后 Navicat 仍能用原密码连接
mysql·adb·docker
好奇的菜鸟3 天前
如何在Ubuntu上检查MySQL是否启动并放开3306端口
mysql·ubuntu·adb
OneT1me3 天前
adb shell中执行system用户权限命令的方法
adb
Polaris_YJH3 天前
360安全卫士占用5037端口(ADB端口)解决方案
adb·端口占用·5037
雨之小13 天前
RK3588调试之旅:adbd服务配置全攻略
adb·rk3588