15

Under Android 4, the following simple native C code line fails with an Permission denied error when not run as root:

online_socket = socket(AF_INET, SOCK_DGRAM, 0);

I do have root access to the device, but want to run the process as non-privileged user.

Note that the error happens even before binding the socket.

I guess there is some security setting that needs to be tweaked? Anyone can tell me where to look?

The O/S is really Android in this case, but I guess the problem is really Linux-related (since Android is based on a Linux Kernel).

For those wondering: This is a custom program that runs in a full (debootstrapped) Debian Jessie installation running in an Android 4 environment.

Update

I've learned that the Android Kernel has a special CONFIG_ANDROID_PARANOID_NETWORK extension that allows network access only to users in AID_INET and AID_NET_RAW groups.

However, even after adding the user to these groups, socket() is still rejected (and ping appears to have the same problem, BTW).

uid=5(imp) gid=51(imp) groups=51(imp),3003(aid_inet),3004(aid_net_raw),3005(aid_admin),3001(aid_bt),3002(aid_bt_net)

I can't tell if that CONFIG_ANDROID_PARANOID_NETWORK flag is set in this particular Kernel, as I don't have access to the config file.

Update 2

I found out that both root and also my unprivileged user imp can in fact successfully call socket() - at least with the groups setup described above.

However, calling the same process as root and then switching to imp using the seteuid() system call prevents socket() from succeeding. Any ideas?

3
  • I don't get an error under Arch linux on an x68_64 laptop. I suspect this is an Android thing.
    – user208139
    Apr 5, 2016 at 13:44
  • Have you tried using a different protocol than "0" (Third parameter)? Eg: 6 for tcp or 17 for udp? Actually, you will have to use Protocol 17 for a udp Datagram socket.
    – gerhard d.
    Apr 5, 2016 at 14:28
  • @gerhardd. - just tried changing protocol to 17, but unfortunately that doesn't help. I should not that the program in question works fine in a number of other, non-Android platforms with Kernels ranging from 2.4 to 4.4
    – Udo G
    Apr 5, 2016 at 14:35

2 Answers 2

20

As it turns out, Android uses a special Kernel patch that's activated with CONFIG_ANDROID_PARANOID_NETWORK. This patch allows network access to system users that belong to certain special groups with hardcoded IDs.

groupadd -g 3001 aid_bt
groupadd -g 3002 aid_bt_net
groupadd -g 3003 aid_inet
groupadd -g 3004 aid_net_raw
groupadd -g 3005 aid_admin

That's because Android normally adds users (i.e. apps) to these groups only when the specific app has networking permissions.

Adding a user to these groups gives it permission to use socket() as described in the question:

usermod -a -G aid_bt,aid_bt_net,aid_inet,aid_net_raw,aid_admin someuser

However, when a process uses seteuid() to switch from root to a unprivileged user (for example someuser), then it's not enough (or probably irrelevant) that this effective user has aid_* group membership. Instead, the root user must explicitly be a member of these groups:

usermod -a -G aid_bt,aid_bt_net,aid_inet,aid_net_raw,aid_admin root

This solved the problem for me.

Note that I've also tried to play with setegid() and similar as an alternative, but none of that helped...

3
  • note that these group names change over time (for instance in android 7, it looks like "inet" is the group you need) but running groups as root lists the groups it is a member of, which are mostly self-explanatory. Apr 6, 2018 at 2:02
  • 2
    usermod command is not available in Android. How do I do this on an Android phone?
    – in3xes
    Nov 26, 2018 at 14:58
  • @in3xes I'm unsure about the OP, but I'm running a an Ubuntu 20.04 chroot inside Android 10. So for me, these commands would be run inside the Ubuntu environment. Jul 14, 2021 at 1:22
3

Those who struggle with the apt-get on Android (with the CONFIG_ANDROID_PARANOID_NETWORK enabled which restricts network access to users who are member of specific groups) there are two workaround:

  1. groupadd -g 3003 aid_inet && usermod -G nogroup -g aid_inet _apt
  2. echo 'APT::Sandbox::User "root";' > /etc/apt/apt.conf.d/01-android-nosandbox

This is because apt-get is running http/https/gpgv methods under a sandboxed user, which is _apt by default:

root      1465  0.0  0.0  31408  4956 pts/0    S    11:48   0:00  |   |       \_ -bash
root     23814  0.1  0.1  65300 10124 pts/0    T    18:58   0:00  |   |           \_ apt-get update
_apt     23818  0.0  0.1  90208  8852 pts/0    T    18:58   0:00  |   |           |   \_ /usr/lib/apt/methods/http
_apt     23819  0.0  0.1  90208  8828 pts/0    T    18:58   0:00  |   |           |   \_ /usr/lib/apt/methods/https
...
3
  • Sweet Jesus custom chroots are complex. Thank you friend, working for me using Android 10 -> chrooted Ubuntu 20.04 Jul 14, 2021 at 1:18
  • Thank you very much! Damn, ubuntu is complex, arch Linux only required editing resolv.conf and everything worked out of box
    – frakod
    Apr 21, 2022 at 7:42
  • 1. group already exists, 2. file doesn't exist Sep 26 at 10:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.