LineageOS Root Privilege Escalation

gistfile1.md

The property checked by adb root can also be set in a normal adb shell session.

lineage-16.0 patches:

• https://review.lineageos.org/c/LineageOS/android_system_core/+/234800
• https://review.lineageos.org/c/LineageOS/android_device_lineage_sepolicy/+/234799

lineage-15.1 patches:

• https://review.lineageos.org/c/LineageOS/android_system_core/+/234801
• https://review.lineageos.org/c/LineageOS/android_device_lineage_sepolicy/+/234804

cm-14.1 patches:

• https://review.lineageos.org/c/LineageOS/android_system_core/+/234802
• https://review.lineageos.org/c/LineageOS/android_vendor_cm/+/234805

Before

adb root
adb shell id
uid=0(root) gid=0(root) groups=0(root),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc),3011(uhid) context=u:r:su:s0

After ( service.adb.root will be renamed to {lineage,cm}.service.adb.root )

adb shell setprop {lineage,cm}.service.adb.root 1
setprop: failed to set property '{lineage,cm}.service.adb.root' to '1'
adb root
adb shell id
uid=2000(shell) gid=2000(shell) groups=2000(shell),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc),3011(uhid) context=u:r:shell:s0