Accessing root files (/system, /dev) from a native library in Android application

Question

I have an NATIVE LIBRARY which will try to create files in the /system, /dev folders in an android device (using open(), fopen() etc).

Now i have integrated the library with an android application using JNI & NDK. But the creation of the files in the root folders are failing. I have tried to create a file in the sdcard from the native library and this works fine.

Neither I want to move the file opening code to Android code (Java code) nor I want to create the files in the sdcard. I have clear requirements to create the files in root folder itself.

Doubleheader

So, have you executed su root or anything similar from your code before trying to create the file? – Ilium

@Ilium I tried Process su = Runtime.getRuntime().exec("su"); This command but it failed saying root permission denied. I am able to get super user through adb shell. – Doubleheader

Access permissions don't change if you move file open operations to Java. – Finder

@AlexCohn I got root access to the device. rocess su = Runtime.getRuntime().exec("su"); is now working. Now instead of giving a 13 (EACCESS denied) open("/system/abc.txt", RW) method is returning 30 (/system is mounted as read only). Although i am remounting the system as read and write after getting "su" – Doubleheader

No, I don't know why your /system is still mounted r/o. You can open adb shell and check what actually happens there. Note that /system and rootfs are mounted separately. – Finder

Answer 1

In recent android versions, rootfs and system are mounted read-only after init has set up the directories and files.

In order to create a file in the system partition you must remount them with write access. So you will have to call on /system/bin/mount as root user.

The command for mounting system rw is different depending on if /system/bin/mount a toybox or toolbox symlink

If you're failing to get su in with Runtime.getRuntime().exec("su"), are you using the su binary produced by aosp in userdebug builds? If so I believe you would have to be shell user in order to use it. Maybe switch to a more commonly available su binary or update the aosp one.

EDIT: for mounting system rw, you first need to determine if /system/bin/mount is a symlink to toybox or to toolbox, because the command they use for mounting system rw will be different

ls -l, or readlink should be able to easily answer that.

for toolbox,

(running as uid(0))

mount -o remount,rw /system

for toybox,

(running as uid(0))

mount -o rw,remount -t auto /system

In Java the subprocess must request su first as only root user can execute the mount command

Anemometer

I had not explicitly rooted the device. But as you had mentioned I had built the OS from an AOSP source. Can you please tell how can i switch or update the su binary? – Doubleheader

I have tried the same code in a phone which is rooted. The open() command failed with an error code 30 (Read only file system). Earlier it was 13 (EACCESS denied). I have root permission and i am executing the following commands to mount the system folder as RW. "mount -o remount,rw /system"; "chmod 777 /system"; – Doubleheader

If you are working on a custom system, you can provide the necessary access permissions specifically to the app you are building, and avoid the risks of su. – Finder

@AlexCohn Is it possible to do that? Do you know what files needs to be modified? I saw the following link but it talks about getting only adb shell access.. #5597639 – Doubleheader

Every app has a unique uid. You can simply apply [chown] for the specific files and/or directories to let the specific app access them r/w. But you still need to remount the rootfs as root, or you can choose to disable the step that mounts rootfs r/o after init. – Finder