Skip to content

Instantly share code, notes, and snippets.

@zifnab06
Last active November 24, 2018 22:48
Show Gist options
  • Save zifnab06/e31ad63596b63a95e061bfe1f49ff0a7 to your computer and use it in GitHub Desktop.
Save zifnab06/e31ad63596b63a95e061bfe1f49ff0a7 to your computer and use it in GitHub Desktop.
LineageOS Root Privilege Escalation

The property checked by adb root can also be set in a normal adb shell session.

lineage-16.0 patches:

lineage-15.1 patches:

cm-14.1 patches:

Before

adb root
adb shell id
uid=0(root) gid=0(root) groups=0(root),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc),3011(uhid) context=u:r:su:s0

After ( service.adb.root will be renamed to {lineage,cm}.service.adb.root )

adb shell setprop {lineage,cm}.service.adb.root 1
setprop: failed to set property '{lineage,cm}.service.adb.root' to '1'
adb root
adb shell id
uid=2000(shell) gid=2000(shell) groups=2000(shell),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc),3011(uhid) context=u:r:shell:s0
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment