1

I've just adb shell'd into my root directory on my device and I want to install the su binary. Just to note, I'm on macOS and want to do this manually.

When I try to push the su binary to the root directory (not on SDCard), I get this error:

$ cp /sdcard/su /system/bin
cp: /system/su: Read-only file system

How do I push the su binary to /system/bin?

(My tablet is an Acer Iconia Tab 10 A3-A30)

Basically, I just want to root it but I can't find any details on unlocking the bootloader or any apps that work with this tablet.

13
  • 1
    Remount the filesystem as read write. See stackoverflow.com/questions/10294808/… Apr 11, 2022 at 19:01
  • 1
    Then you'll have to put it somewhere else. You can't write to a read only filesystem without remounting it read write. Which requires root. Apr 11, 2022 at 19:06
  • 1
    Put it anywhere. Then use it via commandline to remount the file system. Then move it. Apr 11, 2022 at 19:09
  • 1
    Did you chmod it to executable? It should be 755 Apr 11, 2022 at 19:37
  • 1
    You can not root a device by simply installing su. If have to unlock the bootloader, and install a root package like Magisk using a custom recovery, or use an root app that uses an exploit to gain root access (depends on your device and Android version if such an app exists).
    – Robert
    Apr 12, 2022 at 7:37

1 Answer 1

3
+50

Short version: Unfortunately, the naive approach of just pushing "su" won't work. You can verify that (unless your "su" binary is using an exploit), even "adb push su /data/local/tmp/" and then executing it from there won't work.

Detailed version:

Android 5.0 brought two fundamental changes: The first was the sealing of the root and other filesystems, so that they are not only mounted read-only, but they are also verified by DM-verity, such that if they ARE mounted read/write, changes will not be accepted.

The second was the introduction of SE-Linux (along with another change, deprecating setuid binaries), as an extra level of what is known as "Mandatory Access Control". This (as opposed to chmod/chown/etc "Discretionary Access Control") means that there is an overarching "security policy", which - once installed - cannot be overridden in any way.

There are thus two ways to root your device:

A) upload a "su" style binary which would somehow find a way around SE-Linux and grant you root privileges. This necessitates exploitation of a security vulnerability to achieve kernel memory access and "patching" of the shell credentials. These are rare enough to be discounted since these vulnerabilities are quickly patched (exceptions being MediaTek devices, for which mtk-su works well).

B) boot the device in a "boot loader unlocked" mode (which you've indeed referred to) in which a pre-patched kernel, with a modified security policy and a root filesystem (technically ,Ramdisk) with a pre-made su and an enabled daemon can be used to give you super user privileges on demand. This was started by ChainFire's 'supersu', and is now the de facto method of Magisk.

Therefore, your question is very much at a dead end. You could modify the root filesystem and install the "older" form of su if this were a development build (as would be shown by "getprop ro.debuggable" or "getprop ro.build.fingerprint" with "eng" it. But, this will not work on a release (retail) device.

Your best bet is to

  • A) get the OTA or factory image of your tablet in question.
  • B) get the boot.img from it
  • C) Patch the boot.img using magisk (on device, through /sdcard/Download) or imjtool
  • D) Enable boot loader unlocking (not guaranteed to be available) through Developer Options
  • E) put device in fastboot mode ("adb reboot bootloader" should do)
  • F) Use "fastboot flashing unlock" on host when device is thus connected. Approve unlocking
  • G) use "fastboot boot " or (when you are certain it works) "fastboot flash boot "
  • H) Hope for the best
3
  • How do I use Imjtool to install MagiskSU? Magisk gives me "process error" when I try to use it. Apr 15, 2022 at 7:02
  • For future reference In case you cant fulfill "get the OTA or factory image of your tablet in question." 1.Get into root adb shell 2.Then dd your boot.img
    – Tanzin
    Oct 20, 2022 at 16:33
  • Tanzin - it's a chicken and egg. If you could also root via Magisk that means your boot.img was patched already. If not, you'd need the boot.img in order to apply Magisk. Oct 26, 2022 at 14:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.