After a bit of tinkering and some insight from Chainfire and imoseyon i was finally able to get SuperSU working on AOSP roms without being permissive or having to use Chainfire's prebuilt sepolicy
sepolicy patch is here: https://github.com/PureNexusProject...mmit/0f5072de4580a5db7348917e77e4c1c35d3e3c1a
Stickied.
sorry to be that guy, but how does this affect the average joe?
does it mean theres going to be a new version of supersu with this or does this mean that custom rom makers can use this patch to make there roms not need the the custom boot.img?
WarningHPB said:
sorry to be that guy, but how does this affect the average joe?
Click to expand...
Click to collapse
It doesn't, this is for ROM devs only, they know what to do with this.
Chainfire said:
It doesn't, this is for ROM devs only, they know what to do with this.
Click to expand...
Click to collapse
Welcome back! Hope you had a good break.
Chainfire said:
Stickied.
Click to expand...
Click to collapse
Thanks after including this in my AOSP builds i have noticed a few things, certain "root" app still dont function and get selinux denials. i originally had noticed this with logcat extreme. i was getting read and write denials on logd so i did an audit2allow on my sepolicy and came up with the following allow
Code:
#============= logd ==============
allow logd init:fifo_file { read write };
i did a quick google search on this and came up with https://gist.github.com/poliva/fc5b7402bde74be27518 which is apparently an sediff of your sepolicy, which is heavily modified beyond just what i had for supersu to work in enforcing for aosp roms. so i guess my real question is do us "AOSP" devs have to update our sepolicys with these 300+ additions to get all current root apps working or is this something that you can overcome in an update to SuperSU.
thanks in advance :good:
BeansTown106 said:
Thanks after including this in my AOSP builds i have noticed a few things, certain "root" app still dont function and get selinux denials. i originally had noticed this with logcat extreme. i was getting read and write denials on logd so i did an audit2allow on my sepolicy and came up with the following allow
Code:
#============= logd ==============
allow logd init:fifo_file { read write };
i did a quick google search on this and came up with https://gist.github.com/poliva/fc5b7402bde74be27518 which is apparently an sediff of your sepolicy, which is heavily modified beyond just what i had for supersu to work in enforcing for aosp roms. so i guess my real question is do us "AOSP" devs have to update our sepolicys with these 300+ additions to get all current root apps working or is this something that you can overcome in an update to SuperSU.
thanks in advance :good:
Click to expand...
Click to collapse
There is no such thing now as "all current root apps working".
If SuperSU's deamon can be launched, and it can in turn launch the supolicy tool, most of the rules from the diff will be modified by SuperSU as needed.
What your patch needs to do (and you have already done) is make sure SuperSU can be launched in the right context, and can modify the sepolicy. You do not need to implement those 300+ additions - it will be done at boot automagically.
As for those additions themselves, they are primarily needed to:
- make sure SuperSU can work, internal communications between the different processes and such
- make processes running as the "init" context (where root apps run by default) as powerful as possible
- specifically "allow" a number of things that would otherwise still work, but would be logged (everything that starts with "allow init" or "allow recovery")
Now, even with the above, still not everything works out of the box. Everything that goes from "init" to "non-init" context should already work, but going from "non-init" context to "init" may not. In your example case, we go from "logd" to "init", which isn't specifically allowed. Often apps can be fixed to work around an issue such as this.
Generally speaking, the solution is not to fix the source sepolicy or the supolicy tool, the solution is for the "logcat extreme" app to run the following at launch (as documented in How-To SU):
Code:
supolicy --live "allow logd init fifo_file { read write }"
In this specific case, maybe it could be added to supolicy, it depends on what exactly generates the audit. If it's a simple logcat command, it's a candidate for inclusion. The problem might even be solved by switching contexts rather than modifying any SELinux policies. But that is something for the app developer to figure out.
In either case, it is not something you need to fix in the AOSP patches. Those already do what they need to do.
Since they started doing SELinux Enforcing though, the policies in AOSP have generally been a tad stricter than on retail devices (this was specifically the case during 4.4 days). This may lead to you sometimes having to add/remove a rule manually somewhere that was not added to SuperSU yet. It could happen, but it's unlikely, probably temporary, and it probably should not go into this AOSP patch.
A note on pof's sediff, I'm not sure it was done cleanly, as I see some modifications in there that are not done by supolicy. Either way, such a post is informative, not leading, as supolicy may do more or less modifications depending on various runtime variables (such as Android version). Additionally, due to context names and availabilities changing between Android versions, any rule modification referencing a context not available in the to-be-patched sepolicy will not be applied, and thus will not show up in an sediff.
@BeansTown106
Have you checked by any chance if this patch is enough to allow 2.61 (systemless) to work still ?
Chainfire said:
@BeansTown106
Have you checked by any chance if this patch is enough to allow 2.61 (systemless) to work still ?
Click to expand...
Click to collapse
thanks for the description above now i understand. have never developed a root app so i had not read that part of how to su, but it makes perfect sense that the root apps would handle the denials live via your supolicy
as for system less root i have not tried that yet but i will give it a shot tonight, and report back, i know some people in my ROM thread have used system less root. but i am not sure if you had packaged your sepolicy in the install script for 2.61+ and if it is overwriting mine in the kernel, if that is the case i will modify the installation to not patch the sepolicy and see if it works with my pre compiled one based on the source above
Starting 2.64, I think this addition to init.te is all that is needed:
Code:
allow init kernel:security load_policy;
Confirmation needed though. The original patch will also work with 2.64, and the ZIP installer should default to /system installation mode.
Of course, this also requires that /system isn't verified by dm-verity, and init reloads sepolicy from the standard /data/security/current location.
the link in OP its no longer working...
Also in CM13 tree we have:
Code:
# Reload policy upon setprop selinux.reload_policy 1.
# Note: this requires the following allow rule
# allow init kernel:security load_policy;
and over my builds have no problem with SuperSU system less...
Chainfire said:
Starting 2.64, I think this addition to init.te is all that is needed:
Code:
allow init kernel:security load_policy;
Confirmation needed though. The original patch will also work with 2.64, and the ZIP installer should default to /system installation mode.
Of course, this also requires that /system isn't verified by dm-verity, and init reloads sepolicy from the standard /data/security/current location.
Click to expand...
Click to collapse
will build and test with only load policy enabled, is this for system, and systemless root?
danieldmm said:
the link in OP its no longer working...
Also in CM13 tree we have:
Code:
# Reload policy upon setprop selinux.reload_policy 1.
# Note: this requires the following allow rule
# allow init kernel:security load_policy;
and over my builds have no problem with SuperSU system less...
Click to expand...
Click to collapse
updated link, so your saying systemless supersu works with no selinux modifications?
BeansTown106 said:
updated link, so your saying systemless supersu works with no selinux modifications?
Click to expand...
Click to collapse
Over my builds yes, no issues at all in cm13, although my kernel it's in permissive mode. Maybe it's why it works all good?
Enviado do meu A0001 através de Tapatalk
danieldmm said:
Over my builds yes, no issues at all in cm13, although my kernel it's in permissive mode. Maybe it's why it works all good?
Enviado do meu A0001 através de Tapatalk
Click to expand...
Click to collapse
that is why, these patchs are to allow you to run in enforcing
I dont know if a should post here this question: there is any way to fix this problem with the rom already installed?
Thanks
Garzla said:
I dont know if a should post here this question: there is any way to fix this problem with the rom already installed?
Thanks
Click to expand...
Click to collapse
Try the following. It works for me when needed...
http://forum.xda-developers.com/showthread.php?t=3574688
Thank you for your work!
Link in OP its no longer working...
Is there any actual guide how to add SU directly to AOSP build. I have found bits and pieces but those are mainly 4.x releases.
I'm using Android M release and quite much struggling to get it working.
I have tried to make SU default on AOSP 6.0 by using this guide.
http://forum.khadas.com/t/gapps-and-su-on-soc/118/3
I'm using user build and enabled selinux permissive on that.
i have made also ro.secure=0 ro.debuggable=1 and security.perf_harden=0 (Not sure if needed)
I have also modified to change the su permissions in fs_config.c
I managed to get this work so that when flashing rom SuperSu ask for updating su binary and after that su works.
but i then cleaned work area to verify build by deleting out dir and recompiled. No go anymore.
Why it's so hard to add su by default on AOSP rom. I woud like to have it by default so i would not need to do any tricks everytime i flash new rom.
It reminds me of Korean dramas ,
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Welcome to the Magisk Release / Announcement thread!
For all up-to-date info and links, please directly check Magisk's GitHub PageInstallation
Download count of previously XDA hosted files: 25,490,945
v1: 8746 v2: 2251 v3: 3790 v4: 1220 v5: 2914
v6: 138838 v7: 119744 v8: 116796 v9: 203836 v10.2: 215176
v11.1: 573322 v11.6:438886 v12.0: 3263706
1300: 274438 1310: 1018692 1320: 403556 1330: 1844372
1350: 39188 1360: 69874 1400: 4456314
1410: 11512 1420: 112020 1437: 247988 1455: 30652
1456: 253042 1468: 85978 1500: 434572 1510: 460120
1520: 927436 1530: 218164 1531: 3143686 1540: 97368
1600: 6043710 1610: 87628 1620: 140382
Changelog
Magisk
v20.3
- [MagiskBoot] Fix lz4_legacy decompression
v20.2
- [MagiskSU] Properly handle communication between daemon and application (root request prompt)
- [MagiskInit] Fix logging in kmsg
- [MagiskBoot] Support patching dtb/dtbo partition formats
- [General] Support pre-init sepolicy patch in modules
- [Scripts] Update magisk stock image backup format
v20.1
- [MagiskSU] Support component name agnostic communication (for stub APK)
- [MagiskBoot] Set proper header_size in boot image headers (fix vbmeta error on Samsung devices)
- [MagiskHide] Scan zygote multiple times
- [MagiskInit] Support recovery images without /sbin/recovery binary. This will fix some A/B devices unable to boot to recovery after flashing Magisk
- [General] Move acct to prevent daemon being killed
- [General] Make sure "--remove-modules" will execute uninstall.sh after removal
v20.0
- [MagiskBoot] Support inject/modify mnt_point value in DTB fstab
- [MagiskBoot] Support patching QCDT
- [MagiskBoot] Support patching DTBH
- [MagiskBoot] Support patching PXA-DT
- [MagiskInit] [2SI] Support non A/B setup (Android 10)
- [MagiskHide] Fix bug that reject process names with ":"
- [MagicMount] Fix a bug that cause /product mirror not created
v19.4
- [MagiskInit] [SAR] Boot system-as-root devices with system mounted as /
- [MagiskInit] [2SI] Support 2-stage-init for A/B devices (Pixel 3 Android 10)
- [MagiskInit] [initramfs] Delay sbin overlay creation to post-fs-data
- [MagiskInit] [SARCompat] Old system-as-root implementation is deprecated, no more future changes
- [MagiskInit] Add overlay.d support for root directory overlay for new system-as-root implementation
- [MagiskSU] Unblock all signals in root shells (fix bash on Android)
- [MagicMount] Support replacing files in /product
- [MagiskHide] Support Android 10's Zygote blastula pool
- [MagiskHide] All random strings now also have random length
- [MagiskBoot] Allow no recompression for ramdisk.cpio
- [MagiskBoot] Support some weird Huawei boot images
- [General] Add new "--remove-modules" command to remove modules without root in ADB shell
- [General] Support Android 10 new APEX libraries (Project Mainline)
v19.3
- [MagiskHide] Hugely improve process monitor implementation, hopefully should no longer cause 100% CPU and daemon crashes
- [MagiskInit] Wait for partitions to be ready for early mount, should fix bootloops on a handful of devices
- [MagiskInit] Support EROFS used in EMUI 9.1
- [MagiskSU] Properly implement mount namespace isolation
- [MagiskBoot] Proper checksum calculation for header v2
v19.2
- [General] Fix uninstaller
- [General] Fix bootloops on some devices with tmpfs mounting to /data
- [MagiskInit] Add Kirin hi6250 support
- [MagiskSU] Stop claiming device focus for su logging/notify if feasible
This fix issues with users locking Magisk Manager with app lock, and prevent
video apps get messed up when an app is requesting root in the background.
v19.1
- [General] Support recovery based Magisk
- [General] Support Android Q Beta 2
- [MagiskInit] New sbin overlay setup process for better compatibility
- [MagiskInit] Allow long pressing volume up to boot to recovery in recovery mode
- [MagicMount] Use proper system_root mirror
- [MagicMount] Use self created device nodes for mirrors
- [MagicMount] Do not allow adding new files/folders in partition root folder (e.g. /system or /vendor)
v19.0
- [General] Remove usage of magisk.img
- [General] Add 64 bit magisk binary for native 64 bit support
- [General] Support A only system-as-root devices that released with Android 9.0
- [General] Support non EXT4 system and vendor partitions
- [MagiskHide] Use Zygote ptracing for monitoring new processes
- [MagiskHide] Targets are now per-application component
- [MagiskInit] Support Android Q (no logical partition support yet!)
- [MagiskPolicy] Support Android Q new split sepolicy setup
- [MagiskInit] Move sbin overlay creation from main daemon post-fs-data to early-init
- [General] Service scripts now run in parallel
- [MagiskInit] Directly inject magisk services to init.rc
- [General] Use lzma2 compressed ramdisk in extreme conditions
- [MagicMount] Clone attributes from original file if exists
- [MagiskSU] Use ACTION_REBOOT intent to workaround some OEM broadcast restrictions
- [General] Use skip_mount instead of auto_mount: from opt-in to opt-out
v18.1
- [General] Support EMUI 9.0
- [General] Support Kirin 960 devices
- [General] Support down to Android 4.2
- [General] Major code base modernization under-the-hood
v18.0
- [General] Migrate all code base to C++
- [General] Modify database natively instead of going through Magisk Manager
- [General] Deprecate path /sbin/.core, please start using /sbin/.magisk
- [General] Boot scripts are moved from <magisk_img>/.core/<stage>.d to /data/adb/<stage>.d
- [General] Remove native systemless hosts (Magisk Manager is updated with a built-in systemless hosts module)
- [General] Allow module post-fs-data.sh scripts to disable/remove modules
- [MagiskHide] Use component names instead of process names as targets
- [MagiskHide] Add procfs protection on SDK 24+ (Nougat)
- [MagiskHide] Remove the folder /.backup to prevent detection
- [MagiskHide] Hide list is now stored in database instead of raw textfile in images
- [MagiskHide] Add "--status" option to CLI
- [MagiskHide] Stop unmounting non-custom related mount points
- [MagiskSU] Add FLAG_INCLUDE_STOPPED_PACKAGES in broadcasts to force wake Magisk Manager
- [MagiskSU] Fix a bug causing SIGWINCH not properly detected
- [MagiskPolicy] Support new av rules: type_change, type_member
- [MagiskPolicy] Remove all AUDITDENY rules after patching sepolicy to log all denies for debugging
- [MagiskBoot] Properly support extra_cmdline in boot headers
- [MagiskBoot] Try to repair broken v1 boot image headers
- [MagiskBoot] Add new CPIO command: "exists"
v17.3
- [MagiskBoot] Support boot image header v1 (Pixel 3)
- [MagiskSU] No more linked lists for caching su_info
- [MagiskSU] Parse command-lines in client side and send only options to daemon
- [MagiskSU] Early ACK to prevent client freezes and early denies
- [Daemon] Prevent bootloops in situations where /data is mounted twice
- [Daemon] Prevent logcat failures when /system/bin is magic mounting, could cause MagiskHide to fail
- [Scripts] Switch hexpatch to remove Samsung Defex to a more general pattern
- [Scripts] Update data encryption detection for better custom recovery support
v17.2
- [ResetProp] Update to AOSP upstream to support serialized system properties
- [MagiskInit] Randomize Magisk service names to prevent detection (e.g. FGO)
- [MagiskSU] New communication scheme to communicate with Magisk Manager
v17.0/17.1
- [General] Bring back install to inactive slot for OTAs on A/B devices
- [Script] Remove system based root in addon.d
- [Script] Add proper addon.d-v2 for preserving Magisk on custom ROMs on A/B devices
- [Script] Enable KEEPVERITY when the device is using system_root_image
- [Script] Add hexpatch to remove Samsung defex in new Oreo kernels
- [Daemon] Support non ext4 filesystems for mirrors (system/vendor)
- [MagiskSU] Make pts sockets always run in dev_pts secontext, providing all terminal emulator root shell the same power as adb shells
- [MagiskHide] Kill all processes with same UID of the target to workaround OOS embryo optimization
- [MagiskInit] Move all sepolicy patches pre-init to prevent Pixel 2 (XL) boot service breakdown
v16.7
- [Scripts] Fix boot image patching errors on Android P (workaround the strengthened seccomp)
- [MagiskHide] Support hardlink based ns proc mnt (old kernel support)
- [Daemon] Fix permission of /dev/null after logcat commands, fix ADB on EMUI
- [Daemon] Log fatal errors only on debug builds
- [MagiskInit] Detect early mount partname from fstab in device tree
v16.6
- [General] Add wrapper script to overcome weird LD_XXX flags set in apps
- [General] Prevent bootloop when flashing Magisk after full wipe on FBE devices
- [Scripts] Support patching DTB placed in extra sections in boot images (Samsung S9/S9+)
- [Scripts] Add support for addon.d-v2 (untested)
- [Scripts] Fix custom recovery console output in addon.d
- [Scripts] Fallback to parsing sysfs for detecting block devices
- [Daemon] Check whether a valid Magisk Manager is installed on boot, if not, install stub APK embedded in magiskinit
- [Daemon] Check whether Magisk Manager is repackaged (hidden), and prevent malware from hijacking com.topjohnwu.magisk
- [Daemon] Introduce new daemon: magisklogd, a dedicated daemon to handle all logcat related monitoring
- [Daemon] Replace old invincible mode with handshake between magiskd and magisklogd, one will respwan the other if disconnected
- [Daemon] Support GSI adbd bind mounting
- [MagiskInit] Support detecting block names in upper case (Samsung)
- [MagiskBoot] Check DTB headers to prevent false detections within kernel binary
- [MagiskHide] Compare mount namespace with PPID to make sure the namespace is actually separated, fix root loss
- [MagiskSU] Simplify su_info caching system, should use less resources and computing power
- [MagiskSU] Reduce the amount of broadcasting to Magisk Manager
- [ImgTool] Separate all ext4 image related operations to a new applet called "imgtool"
- [ImgTool] Use precise free space calculation methods
- [ImgTool] Use our own set of loop devices hidden along side with sbin tmpfs overlay. This not only eliminates another possible detection method, but also fixes apps that mount OBB files as loop devices (huge thanks to dev of Pzizz for reporting this issue)
v16.4
- [Daemon] Directly check logcat command instead of detecting logd, should fix logging and MagiskHide on several Samsung devices
- [Daemon] Fix startup Magisk Manager APK installation on Android P
- [MagiskPolicy] Switch from AOSP u:r:su:s0 to u:r:magisk:s0 to prevent conflicts
- [MagiskPolicy] Remove unnecessary sepolicy rules to reduce security penalty
- [Daemon] Massive re-design /sbin tmpfs overlay and daemon start up
- [MagiskInit] Remove magiskinit_daemon, the actual magisk daemon (magiskd) shall handle everything itself
- [Daemon] Remove post-fs stage as it is very limited and also will not work on A/B devices; replaced with simple mount in post-fs-data, which will run ASAP even before the daemon is started
- [General] Remove all 64-bit binaries as there is no point in using them; all binaries are now 32-bit only.
Some weirdly implemented root apps might break (e.g. Tasker, already reported to the developer), but it is not my fault
- [resetprop] Add Protobuf encode/decode to support manipulating persist properties on Android P
- [MagiskHide] Include app sub-services as hiding targets. This might significantly increase the amount of apps that could be properly hidden
v16.3
- [General] Remove symlinks used for backwards compatibility
- [MagiskBoot] Fix a small size calculation bug
v16.2
- [General] Force use system binaries in handling ext4 images (fix module installation on Android P)
- [MagiskHide] Change property state to disable if logd is disabled
v16.1
- [MagiskBoot] Fix MTK boot image packaging
- [MagiskBoot] Add more Nook/Acclaim headers support
- [MagiskBoot] Support unpacking DTB with empty kernel image
- [MagiskBoot] Update high compression mode detection logic
- [Daemon] Support new mke2fs tool on Android P
- [resetprop] Support Android P new property context files
- [MagiskPolicy] Add new rules for Android P
v16.0
- [MagiskInit] Support non skip_initramfs devices with slot suffix (Huawei Treble)
- [MagiskPolicy] Add rules for Magisk Manager
- [Compiler] Workaround an NDK compiler bug that causes bootloops
v15.4
- [MagiskBoot] Support Samsung PXA, DHTB header images
- [MagiskBoot] Support ASUS blob images
- [MagiskBoot] Support Nook Green Loader images
- [MagiskBoot] Support pure ramdisk images
- [MagiskInit] Prevent OnePlus angela sepolicy_debug from loading
- [MagiskInit] Obfuscate Magisk socket entry to prevent detection and security
- [Daemon] Fix subfolders in /sbin shadowed by overlay
- [Daemon] Obfuscate binary names to prevent naive detections
- [Daemon] Check logd before force trying to start logcat in a loop
v15.3
- [Daemon] Fix the bug that only one script would be executed in post-fs-data.d/service.d
- [Daemon] Add MS_SILENT flag when mounting, should fix some devices that cannot mount magisk.img
- [MagiskBoot] Fix potential segmentation fault when patching ramdisk, should fix some installation failures
v15.2
- [MagiskBoot] Fix dtb verity patches, should fix dm-verity bootloops on newer devices placing fstabs in dtb
- [MagiskPolicy] Add new rules for proper Samsung support, should fix MagiskHide
- [MagiskInit] Support non skip_initramfs devices using split sepolicies (e.g. Zenfone 4 Oreo)
- [Daemon] Use specific logcat buffers, some devices does not support all log buffers
- [scripts] Update scripts to double check whether boot slot is available, some devices set a boot slot without A/B partitions
v15.1
- [MagiskBoot] Fix faulty code in ramdisk patches which causes bootloops in some config and fstab format combos
v15.0
- [Daemon] Fix the bug that Magisk cannot properly detect /data encryption state
- [Daemon] Add merging /cache/magisk.img and /data/adb/magisk_merge.img support
- [Daemon] Update to upstream libsepol to support cutting edge split policy custom ROM cil compilations
Magisk Manager
v7.5.1
- Fix toggling app components in MagiskHide screen
- Update translations
v7.5.0
- Support new MagiskSU communication method (ContentProvider)
- Fix several issues with hidden stub APK
- Support using BiometricPrompt (face unlock)
v7.4.0
- Hide Magisk Manager with stub APKs on Android 9.0+
- Allow customizing app name when hiding Magisk Manager
- Generate random keys to sign the hidden Magisk Manager to prevent signature detections
- Fix fingerprint UI infinite loop
v7.3.5
- Sort installed modules by name
- Better pre-5.0 support
- Fix potential issues when patching tar files
v7.3.4
- App is now fully written in Kotlin!
- New downloading system
- Add new "Recovery Mode" to Advanced Settings
v7.3.0/1/2
- HUGE code base modernization, thanks @diareuse!
- More sweet changes coming in the future!
- Reboot device using proper API (no more abrupt reboot)
- New floating button in Magisk logs to go to bottom
v7.2.0
- Huge UI overhaul
- More sweet changes coming in the future!
v7.1.2
- Support patching Samsung AP firmware
- Much better module downloading mechanism
v7.1.1
- Fix a bug that causes some modules using new format not showing up
v7.1.0
- Support the new module format
- Support per-application component granularity MagiskHide targets (only on v19+)
- Ask for fingerprint before deleting rules if enabled
- Fix the bug that causes repackaging to lose settings
- Several UI fixes
v7.0.0
- Major UI redesign!
- Render Markdown natively (no more buggy WebView!)
- Support down to Android 4.1 (native Magisk only support Android 4.2 though)
- Significantly improve Magisk log disply performance
- Fix post OTA scripts for A/B devices
- Reduce memory usages when verifying and signing boot image
- Drop support for Magisk lower than v18.0
v6.1.0
- Introduce new downloading methods: no longer uses buggy system Download Manager
- Introduce many new notifications for better user experience
- Add support for Magisk v18.0
- Change application name to "Manager" after hiding(repackaging) to prevent app name detection
- Add built-in systemless hosts module (access in settings)
- Auto launch the newly installed app after hiding(repackaging) and restoring Magisk Manager
- Fix bug causing incomplete module.prop in modules to have improper UI
v6.0.1
- Update to use new online module's organizing method
- When fingerprint authentication is enabled, toggling root permissions in "Superuser" section now requires fingerprint beforehand
- Fix crashes when entering MagiskHide section on some devices
- Remove support to Magisk version lower than v15.0
- Ask storage permissions before patching stock boot image
- Update dark theme CardView color
v6.0.0
- Update to latest AndroidX support library
- Fix crashes when online repos contain incomplete metadata
- Optimize BootSigner to use as little memory as possible, prevent OutOfMemoryError
- Support new communication scheme between Magisk v17.2 and Magisk Manager
- Enable excessive obfuscation to prevent APK analysis root detections (still not 100% obfuscated due to backwards compatibility with stable channel)
2016.10.04
Magisk-v7 is quite a significant update compared to v6. A lot has changed, new features are added, and improved compatibility a lot, especially in selinux issues.
Open Source!
My previous releases has some controversy due to the fact that I included closed source property with unexpected intentions. I had worked hard to create/improve open source tools, so that they can fit my own needs. Magisk is now 100% open source, including the binary it uses.
Brand New Magisk Manager
The Magisk Manager is completely a different application compared to the previous crappy app. It has now packed with features, and it is now part of the core experience of Magisk itself. New features and improvements are still planned, so stay tuned in this application's development!
Repo System, Module Management
We've been putting a lot of effort into constructing this repo system. This change is to make installing Magisk Modules a lot more easier. What I'm aiming is to make Magisk something like Xposed, an interface and a platform for developers to work on. Providing a repo system is a good step towards the goal, as it makes installing new stuffs and receiving updates super simple. I also drastically simplified the Magisk Module template. Right now, I believe anyone with basic knowledge can create their own Magisk Module easily. Changing a few values into a config file should make porting existing mods to Magisk much easier.
Safety Net
My decision to remove root management from Magisk seems to cause some debate. People might wonder why I would remove such feature that made Magisk so popular. Well, I have to emphasize again, Magisk is never meant for bypassing Safety Net. The Xposed and root bypasses are some fun projects that I'm messing with what Magisk is capable of. One of the two main reasons I dropped this feature in Magisk is
1. Xposed is no longer working with Safety Net enabled. I had tried to bypass it with some mounting tricks and process killing, but all of those are not able to fix the issue. Soon suhide is available and it is able to bypass Xposed had made me really frustrated, as I do not want to keep working on a "not complete solution".
2. On the open source side, phh is also developing his own "suhide". phh just released a test build for hiding root (link to his test build), I'm gonna take a look and include it into the Magisk version of phh root.
These two methods are much better than the one I was using. It doesn't need a toggle, it is per app basis, and many more. Also, I'm not creating a root solution, I'm creating an interface that root solutions can rely on. So I decide to give the hiding root "responsibility" to the root solutions, not managed by the interface, Magisk, itself.
Just to let all of you know, one of Magisk Manager's future feature will be a GUI to manage these two root hiding solutions. It will need some time to develop, and I also wanted to do some things in the core Magisk side to add this support natively. So please don't be pissed that I dropped the whole root management thing. It is for a bigger plan
Due to a bug in the template zip, there will be issues flashing the zip files if the path has spaces.
This commit in magisk-module-template should fix the issue.
All repos online is updated with this fix, developers please include this patch into your modules.
2016.10.19 Magisk v8
This release is aimed for bug fixes, and most importantly the ability to hide itself from Safety Net's detection.
Template Cache Module Fix
Due to a bug in the template script, if your module is a cache module, your scripts might not be executed correctly, also flashing in Magisk Manager will cause the UI to break.
This particular commit is the fix, only cache modules are needed to be updated, other modules are working fine.
Search Bar in Download Section
Magisk Manager 2.1 brings search bar to the "Downloads Section", so that it's easier to find a module once the list gets too long.
SuperSU Integration
In the previous release (v7), I decided to automatically convert SuperSU into a Magisk module while installing Magisk. In this release (v8), I make Magisk 100% compatible with SuperSU out of box, not needed to modify how SuperSU work in anyway. For v8 and future releases, Magisk will detect SuperSU patched boot image, and only add the required additional patches to the boot image.
Also, I created further integration for Magisk and SuperSU: Magisk will create a script placed in /data/custom_ramdisk_patch.sh when SuperSU detected. What this means is that the next time you upgrade SuperSU by flashing SuperSU zip in custom recovery, Magisk will automatically be injected. You can also apply OTA updates with FlashFire, and enable SuperSU injection, which will also inject Magisk on-the-go!
For users that was using v7 with SuperSU along with the Helper Module, please manually restore your boot image (should be stored in /data/stock_boot.img), and flash the latest SuperSU, then flash Magisk-v8.
Magisk Hide
This feature should've been released a few weeks ago, but university is killing me lately; overwhelming schoolwork prevents me to finalize the tool, so please pardon my absence and lack of support. But it's still better late than nothing .
In the weeks I have been inactive, Safety Net got a couple updates, each makes bypassing more of an hassle. Magisk v8 introduce "Magisk Hide", the tool to properly hide Magisk, preventing Magisk to break Safety Net features. What it can do is hide all Magisk modules' files and mounts from target processes (e.g. Safety Net), including Magisk compatible phh root maintained by myself.
It cannot hide SuperSU, it cannot hide Xposed. If you want to hide any of them, please use suhide developed by Chainfire.
It should not cause issues as I have been testing quite some while, but if you replace some files with Magisk (known: /system/etc/customize/ACC/default.xml), Google Play Service will constantly crash. Due to this fact, this feature is not enabled by default. You have to manually enable it in the settings of Magisk Manager v2.1 after you upgraded to Magisk v8, and reboot to apply the settings.
Right now, you can manage your own hide list with ways similar to suhide, no GUI:
Code:
(All commands should be run in a root shell)
# Show current list
/magisk/.core/magiskhide/list
# Add new process (the package name should work fine)
/magisk/.core/magiskhide/add <process name or package name>
# Remove a process (might need a reboot to make an effect)
/magisk/.core/magiskhide/rm <process name or package name>
The process com.google.android.gms.unstable (Safety Net) will always automatically be added to the list if Magisk Hide is enabled, so if you just want to bypass Safety Net, just enable in Magisk Manager and you're good to go.
Safety Net - The Already Lost Cat-And-Mouse Game
Keep in mind, in the latest update of Safety Net that just happened in a few hours, Google seems to step up the game, and it might got to the point that no modifications are allowed, and might be impossible to bypass.
Currently on my HTC 10, no matter what I did to the boot image, even just a repack of 100% stock boot image, Safety Net will not pass under any circumstances. On the other hand, my Nexus 9 running stock Nougat seems bypass without issues, with root and modules all enabled and working fine. The boot verification might vary from one OEM to another, HTC's implementation might just be one of the first included into Safety Net, but eventually all major OEMs' method will be included, and at that time I think any Android "mod", including custom kernels, will pretty much break Safety Net. These verification should be coded deep into the bootloader, which is not that easy to crack. So the conclusion is that I will not spend that much time bypassing Safety Net in the future.
The attachment is a screenshot about where to enable Magisk Hide in the app
Magisk MultiROM - POC
I spend some time playing with the possibility of Universal MultiROM by only using Magisk.
Surprisingly, it is not that difficult at all! Here is a small POC video demonstrating my HTC 10 dual booting stock rom and CM 13.
No other dependency is required (e.g. modified TWRP recovery, kext kernel patch etc.). You only need Magisk injected into the boot image, and along with proper settings, by swapping out the boot image, you can load any rom systemless-ly.
What this means is that all Magisk supported device can enjoy MultiROM features! What a great news for flashaholics LOL.
NOTE! The process showed in this video in far from what it will be eventually. I will make the process nice and smooth
2016.11.14 Magisk v9
This release comes with significant updates and changes, doing adjustments to pave the road for the next major update v10: the update with Multirom support!
Please spend some time reading this lengthy release note, the most important information are included in quotes, or bolded and colored in RED.
Also, many other fixes not mentioned here are listed in the changelog.
The End of Cache (post-fs) Modules
This shall be the biggest change for this update. One of Magisk's cool feature is that it can mount files before data and build.prop is loaded (post-fs). Most modules only uses this advantage to modify read-only props (e.g. DPI, fake device model etc.) without modifying build.prop, however with a new tool included in this release (will be introduced in the next section), dealing things in post-fs is not needed anymore.
Instead of having both "Cache Modules" and "Normal Modules" at the same time, confusing both developers and users, creating complexity in module management, the decision is made that "Cache Modules" are no longer supported after this update.
How about some features that require mounting in post-fs mode (known: Changing Boot Animation)? No worries, post-fs mode is still there (as Multirom will depend on this), I only removed the interface for modules.
Magisk no longer let you install cache modules, you have to manually add the files you want to replace, which is actually super easy.
You can place your new files into the corresponding location under /cache/magisk_mount, Magisk will automagiskally manage selinux contexts, permissions and the mounting for you.
For example, you want to replace /system/media/bootanimation.zip, copy your new boot animation zip to /cache/magisk_mount/system/media/bootanimation.zip with any root explorer, Magisk will mount your files in the next reboot.
Click to expand...
Click to collapse
Magisk v9 will remove all installed cache modules under /cache/magisk, which is the previous path where cache modules locate.
Further more, to push developers to upgrade their cache modules, the latest Magisk Manager (v2.5) will filter out cache modules, which means cache modules available in the Magisk repo are NOT shown under the "Download" section in Magisk Manager.
Cache Module developers please refer to the following instructions to update your current module:
Take a look at the changes in this commit (if you're famlier with git, you can just cherry pick this commit, and deal with some minor merge conflicts)
Check the "resetprop" section to understand how to change props without using a cache module, and update your modules accordingly. For example, if you want to replace the build.prop, you no longer need to enable "automount", or bind mount the file manually in your script, as nothing will load it again.; instead, you should enable post-fs-data script, and read your new build.prop file with proper commands. If you want to change certain prop values, just switch from post-fs script to post-fs-data script, and instead of calling "setprop", please call "/data/magisk/resetprop" to set your props.
Remember to remove the "cacheModule" entry or set to false in the module.prop file, or else your module will never show up in the Magisk Download section in the Magisk Manager!
New Badass Tool - resetprop
To be honest, this tool itself deserves a new thread on XDA, as it is super powerful and super cool.
"resetprop", originally named "xsetprop", was initially developed by @nkk71 to bypass the crazy tough detections for Safety Net. Developers found method to bypass the check by modifying the kernel source code, which served the need but the solution is far from perfect as it requires the source code to be available and kernel compiling.
The tool was originally made to directly modify the system prop database. With seeing the potential of this tool, I contacted @nkk71 and start collaborating together, which brings the original simple tool into a full-fledged, all-in-one prop management tool.
Here are some technical details:
System props are handled by "init", a binary located in the ramdisk which starts right after kernel is loaded. "props" are supposed to only have a single writer, and multiple reader, which means only the process "init" has the full control to the prop database. We modify the props (by calling setprop) through an interface called property_service, which will pass the request to init; property_service also handles the triggering of "events" that should be triggered by a prop change. What read-only props means is that property_service will block all requests for modifying props starting with "ro.", as those props are not allowed to be changed once set. To overcome this difficulty, we can mimic how init behaves by directly modifying the trie structured database. However we will not be able to trigger events, as we completely skipped the property_service part. This might be ideal for SN bypasses, but not applicable for Magisk, as I want to load any prop, which should trigger some events to make some changes. So we went a step further and added a feature to "delete" a system prop! As a result, by directly deleting the prop entry in the database, then send a request to property_service, property_service will accept the request and trigger events if needed.
The new tool - resetprop can modify/delete any system prop, including read-only props (prop names starting with "ro.")
You can also read a whole build.prop, overwriting all existing props. The binary will be installed to /data/magisk/resetprop.
Here are some examples for cache module developers to adapt to the new changes:
Code:
# Set any prop (with trigger)
/data/magisk/resetprop ro.sf.lcd_density 480
# Set any prop (without trigger)
/data/magisk/resetprop -n ro.crypto.state encrypted
# Delete any prop
/data/magisk/resetprop --delete magisk.version
# Read props from a prop file
/data/magisk/resetprop --file /magisk/somemod/new_build.prop
Click to expand...
Click to collapse
The tool is originally built with AOSP source, I spent some time to make it much more portable.
Here is the link to the NDK-buildable source of the resetprop used in Magisk: https://github.com/topjohnwu/resetprop
Magisk Hide - Greatly Improved
Another update to pass SN, please grab it before it expires lol
People started to panic when Google device to check boot loader / boot-verity etc. As stated in the previous section, resetprop fixes the issue easily with setting all detecting props to the valid values. However, more detection has been added. One of those is that simply adding Magisk directories into PATH will break Safety Net. Not sure if I should be glad because the word "magisk" is now officially on the tech giant's blacklist......
So in order to hide root (here I'm only referring Magisk phh superuser, as SuperSU users shall always rely on CF's suhide, not MagiskHide), I had to change the way things works.
For the new changes that are required to NOT modify PATH, the phh's superuser has to be upgraded.
Please make sure your phh superuser is upgraded to r266-2 (or any version higher).
Older version will NOT work with Magisk v9, please upgrade phh's su before upgrading.
Also, along with the new Magisk Manager v2.5, we finally had an GUI to add/remove apps from the MagiskHide list!
Click to expand...
Click to collapse
Development
I added build.sh into the main Magisk repo, you can call the script and it will guide you with help messages.
Custom version names are supported, both in Magisk and Magisk Manager (if using custom name, update will disable)
So feel free to clone the repo and develop Magisk yourself! Pull requests are appreciated!
For Magisk Manager, you can provide translations for the app, just translate the strings, create a pull request, and I'll merge it into the main app, many thanks!
Those Pixels
I stated before that the new Google Pixel devices are using a complete different partition structure, as the ramdisk is now stored along with the system partition, and a kernel modification is inevitable.
Without much surprise, our mighty developer Chainfire had released a systemless root for Pixel devices. What it does in a nutshell is bringing back the ramdisk to the boot image, and still do modifications in the ramdisk (rootfs). However it still requires 1. custom init binary 2. binary patch directly to the kernel. If I decide to use the provided closed source solution, it shall not be difficult to port Magisk to the Pixels and start all the systemless craziness, but still I need an device to test and debug. In addition, I would love to see if I can create an open source tool to achieve similar results to make Pixel (which means maybe all future devices) running Magisk.
But the huge issue is: I live in Taiwan, and there is no sign that the Pixels will be available for purchase here, well at least not possible in 2016.
I could ask my buddy studying in the US to bring me one when he comes back at the Christmas vacations (which is still quite some time from now, but still better late than nothing.....), however the problem is that Pixel XLs (the model I prefer) are currently out of stock on the online Google Store, and I will never know if ordering now will make the package show up in my friend's place in time before he comes back to Taiwan.
If anyone seeing this post has access/can purchase brand new Pixel XLs (anywhere should be OK), and possible to deliver them to Taiwan in a reasonable time and a reasonable shipping fee, please contact me and I'll be very happy.
Lastly, I just bought my new HTC 10 within a year. I'm just an university student, the money I earn from tuition could afford me the super expensive Pixel device, but any additional donation to support my open source development is highly appreciated . I'd be really happy that many people love my work!
Click to expand...
Click to collapse
Here are some news....
Lack of Support
School have been super busy lately (getting the last metro to home nearly every day...), I have little if any time to spend on Android development. Another big factor is that I'm still waiting for my laptop to be repaired.
Sorry for all the private messages sending to my inbox, I've got way too many PMs that I'm not in the mood to read through dozens and dozens of them, since a large fraction of them are simply just asking for instructions for installing Magisk on their device.
I prefer REAL issues to be opened on Github, as I check them from time to time, and I can keep track of which are not yet resolved.
Build Friendly
I added build script for Unix-like systems (Linux and macOS) and also for Windows. I tested on all three platforms and all of them are working as expected. For people interested in the latest feature added to Magisk but not included into an official release yet, feel free to build it yourself. I automated the process that even people with no experience in NDK or scripting can build it easily.
Also for people willing to report bugs, please test Magisk built against the latest commit before opening issues on Github, thanks a lot!
Magisk Module Repo?
It has been a while since I last updated the Magisk Module Repo. I know there are a few requests for adding their own modules to the repo. I'm gonna change the way for requests to be handled from the current "posting in a request thread on XDA", to most likely handled through Github. When the new way for requests is decided, I'll add the current requests at once, and close the current thread.
I really appreciate every person who is interested in making a Magisk Module and willing to share it with others, once the new method is decided, the requests should be addressed in a timely manner.
Multirom? Updates?
I've spend my extremely limited free time to fix current Magisk issues, and so far (the latest commit on Github) it has improved a lot compared with the current v9 release.
I haven't really spend much time in the multirom feature, however I found an interesting open source project: DualBootPatcher.
It exists for quite a while, and it is very impressive just like the Multirom Tasssadar created. I haven't looked into how DualBootPatcher works, so I'm not sure if it is using similar tactics method that I switch between systems in a super simple way through Magisk.
2017.1.2 Magisk V10
Happy New Year! What is a better way to celebrate 2017 than a Magisk update
Another massive update!
Official Icon
Instead of using the picture grabbed online, the official Icon for Magisk is now live!
Magisk Hide Back On Stage
This is the most awaited fix, isn't it?
The issue of losing root is haunting since day 1 of the release of Magisk Hide, although it can be temporary recovered with a reboot, it is still quite annoying. I spend a lot of time trying to identify the reason, and soon found out that the issue is caused by MagiskHide reacting "too fast". Most processes starts from Zygote, and it requires a small period of time to isolate the mount namespace apart from Zygote. When MagiskHide reacts too quickly, it will unmount all mounts in the Zygote namespace, which literally means that all processes will lose the mounts (including root).
After adding checks and retries before switching namespaces, it leads to another issue: MagiskHide reacting "too slow". When critical files like framework is Magic Mounted, and the unmounting doesn't happen in time, it will break the SafetyNet checking process (Google Play Service FC), and can never recover until a reboot (or full restart of Google Play Service). I added tons of safety precautions (I won't go into the details here, it will be another few hundred of words), and I can "almost" eliminate all possible breakages.
Due to the fact that Magisk Hide DOES NOT hijack app_process (Zygote), it can only react passively, so there is a limitation to the effectiveness.
The best practice is to NOT add a lot of apps in the blacklist of MagiskHide (managed in Magisk Manager), so that the MagiskHide daemon has the time to react.
Personally I only hide SafetyNet (the preset), and it passes all excessive tests without any issue. However my tester still managed to break it a few times when adding 6 additional apps, and having 10+ accounts syncing at the background all the time. So I guess it is good for most users lol
Magic Mount With No Limits
I'm glad to announce that starting from this update, Magic Mount can do ANYTHING! Thanks to the new mirror implementation and some workarounds in the algorithm, it can now handle adding files to /system root (and /vendor root if separate partition). Also thanks to the new MagiskHide, all mounting combinations can pass SafetyNet!
Magisk Powered Custom ROM: One Click to Custom ROM, Another Click You're Back to Stock
I am a member of an HTC custom ROM developer team - Team Venom, and without too much effort, The world's first Magisk Powered Custom ROMhttp://venomroms.com/worlds-first-100-percent-magisk-rom/ was born!
The advantage over traditional full packaged custom rom is that we ROM developers no longer need to port carrier features (Wi-Fi calling, VOLTE etc.) to our ROMs. Users can install Magisk on their stock devices, load the Custom ROM module, reboot and BOOM all done, along with 100% fully working carrier features. Also, it is just cool to load a custom ROM fully systemless, isn't it!
Developers in the HTC 10 community soon realized the "power of Magisk", and currently trying to push out more and more Magisk Custom ROM Modules.
I hope all developers feel the excitement, and port all stock modified custom ROM to be implemented with Magisk!
For ROM developers interested, please check the link and download the zip to get an idea how to create your own Magisk Custom ROM Module!
Magisk Can Now Root Your Device
I decided to fork the phh Superuser and start doing modifications. From Magisk v10 and after, Magisk will root your device with the bundled root if
a. No root installed b. Root that isn't Systemless SuperSU or older Magisk phh versions installed
Right now you still have to install the phh Superuser application, however the root management should move to Magisk Manager soon, please stay tuned.
Currently it is nearly the same as official phh root with only a few tweaks, but I might add more in the future.
Magisk Manager Now On Play Store
It seems that some already found out that Magisk Manager is now available on Play Store! All future updates will be pushed through Play Store.
Download links will still be posted here, since there are still places where Play Store isn't available.
Documentations Updated, Module Template Updated, New Repo Requests
The documentations here on XDA is pretty outdated, I updated them with more info to assist developers and users to create their own modules.
Module template is updated for an addition option to load a prop file.
Repo requests are also updated, please check out the new instructions!
Sorry guys, in v10 (and the v10.1 if you're fast), when updating within the Magisk Manager, my scripts didn't handle the phh upgrading correctly.
For those got stuck with no root, please flash the latest phh zip downloaded in this thread in custom recovery (or Magisk Manager, because it is the only app that have root access).
Sorry for the inconvenience, please forgive me lol, I'm only one man!
2017.1.11
Magisk Manager v3.1
I'm still dealing with my finals (got an exam tomorrow, and 3 more projects to do......), but the online repo is no longer accessible on Magisk Manager, which forces me to push out an update.
Apart from that critical bug fix, it also comes with a lot of updates and improvements, please check the changelog for further info.
Please update your Magisk Manager from Play Store. The direct link is also updated with the new v3.1 version
Magisk v11.0
2017.2.6 Magisk v11.0
Came back from Chinese New Year holiday with some significant updates!
Introducing MagiskSU
Magisk officially becomes its own rooting solution!
Initially I just want to add root management features into Magisk Manager, but ended up updating lots of code.
Since the changes are quite significant, and no longer compatible with older versions, I'll just name it MagiskSU instead of phh Superuser.
The code is based on phh's approach to update the CM Superuser. I spent quite some effort to achieve SuperSU standards, so far the functionality should be nearly equivalent, my only concern now is compatibility, which is what I will focus on in future releases.
Please note, Magisk is still fully compatible and functional with the latest SuperSU (tested against v2.79-SR3)
The Fully Re-factored sepolicy-inject tool
To accompany with the fresh new MagiskSU, I also spent a ton of effort re-factoring the tool sepolicy-inject.
The tool now accepts policy statements, you can get more info about it from from this section of @Chainfire 's wonderful How-To SU documentation.
Basically I aimed to follow the same syntax as SuperSU's supolicy tool, as it is straight forward and same as the .te policy sources. I added a few additional features in sepolicy-inject, you can directly execute the binary with no options to refer to the help info.
See all changes in the changelog
(I named it "sepolicy-inject" instead of "supolicy", since it still differs in many ways (e.g the built-in rules) even though the syntax is now nearly identical. Root app developers might want to handle this difference when live patching sepolicies)
Pseudo SELinux Enforce Mode
Thanks to the new sepolicy-tool, pseudo enforced mode is now possible (the status shows enforced, but actually is permissive).
In some versions of Google Play Services, setting SELinux to permissive causes Safety Net to fail; however some custom ROMs require the system to be in permissive to be fully functional (although it should be considered as a bad practice). This shall be the perfect solution.
This will not be as a switchable option within Magisk Manager, since Google has a history of pulling apps from the Play Store when related to SELinux (see the tragic example of developer @flar2 's awesome app, and there are still more incidents).
MagiskHide binary is now updated to detect the permissive state, patch the current sepolicy to pseudo enforced mode, then switch back to enforced.
ROM developers don't have to change anything, just simply set to permissive on boot with a bundled app or a boot script as usual. If a user decided to enable MagiskHide, it will handle everything itself.
General Purpose Boot Scripts
I removed this feature in Magisk v4 and favored the per-module scripts. Now I decided to bring it back again.
The scripts should be placed in /magisk/.core/post-fs-data.d and /magisk/.core/service.d. The directory name should be self-explanatory.
If you have no idea which to choose, the post-fs-data.d will be a nice bet.
So Magisk will now execute script named post-fs-data.sh in each module, and all files within post-fs-data.d. The same applies to service.
Future
Thank you for everyone providing translations to Magisk Manager, and huge thanks to all donated.
I appreciate all the support, and that is my motivation to continue pumping stuffs out!
I will be maintaining MagiskSU continually; support won't end, at least in the near future.
Magic Mount features and better Magisk Module support are also on my list.
I spent zero time on adding more support to devices in v11, all the effort were put in MagiskSU and MagiskManager and major bug fixes.
The whole project is now in the state I consider "feature-packed" enough, most users/developers haven't used the full potential of the features.
I'll stop adding major new features and instead focusing on bringing Magisk to more devices that currently isn't supported.
And yes, that means I will postpone the long planned but never worked on Multi-ROM feature (I barely spent time on it after the POC video)
Hope you all will enjoy the update
(P.S. It's 9 AM here and I haven't slept. I'll update documentations after some sleep)
Before I got the in-app guides done, here are some tips for you
Many people seems missing these details
2017.2.19 Magisk Manager v4.2
Magisk Manager v4.2 is now live on Play Store. OP direct links are also updated accordingly.
Tons of improvements to the app, check the changelog for more info
Where is the Magisk Update?
I'm aware there are issue in Magisk v11.1 (vendor mount issues, and MagiskSU system rw issue)
I already fixed the system rw MagiskSU issue (so TiBack now 100% functional), you can check the Superuser sources if you're interested into the solution
I'll push an update soon after I fixed all currently known issues, AND add compatibility to more devices.
Please note that I'm only one single man, and also got a real life to deal with, so I can only focus one thing at a time.
I decided to first improve the Magisk Manager application to a point I think it's acceptable. Android application development is quite tedious, I have to put quite some time and effort into it.
After this Magisk Manager update, I will put all my attention on the core Magisk part, so please stay tuned!
New Online Module Info Display
I updated the way Magisk Manager show the details of Online Magisk Modules in the repo.
Previously I let each module include a changelog.txt, donate link, and support link
However, I think it would be better to let module developers to write anything they want
And considering the text rendering needs to be nice and clean, I think Markdown is the best choice here!
You can include links to your thread, links to your donation link, download link for an app required, changelog.... anything!
All Repo Developers Aware!
In Magisk Manager v4.2, the app will read the README.md file within your repo, and render the file properly
The changelog.txt file, support and donate entry within module.prop are no longer read, they can be removed.
Please update your README.md file ASAP to let the new app properly display what your modules do.
Here is an example, I updated the Xposed module's README.md, you can see the results in attachments
This is also a screenshot of what the new UI looks like
Magisk Manager v4.2.5 is live!
Hot fix for Samsung crashes (theoretically, no device to test), also did several adjustments here and there
As usual, full changelog in 2nd post, direct links and Play Store (might need to wait a few hours) are also updated
Sorry for the inconvenience!
Magisk Manager v4.2.6
Finally got the Samsung crash fixed!! Thank you for everyone reporting giving feedback, really appreciate the community!
As a compensate for the frequent updates and inconvenience, I added another feature that was requested to Magisk Manager - add a setting to disable update notifications
Play Store might take a few hours to update, direct link in OP is updated
Finally, I can now focus on the core part, which IMO is much much more important
Device compatibility should be GREATLY improved once the work is done, stay tuned!
For Pixel support though, I'll need to borrow my friend's Pixel XL for a couple of weeks to develop, but this might not happen soon since school is quite busy.
2017.3.21 Magisk v11.5/v11.6
It's about time for some Magisk update!!
Magisk Binary Changes
The original tool sepolicy-inject is now renamed to magiskpolicy. However, for backward compatibility, a symlink named sepolicy-inject will be created, which simply just links to magiskpolicy
The original tool bootimgtools is now renamed to magiskboot, which is a complete rewrite of the existing boot image patching tool. More info later.
Starting from this release, magiskpolicy, sepolicy-inject, resetprop, and if MagiskSU is installed, su, and supolicy (this is NOT the SuperSU supolicy, it just links to magiskpolicy, exists for compatibility) are all added to the PATH, which means you can directly call these commands through shell (and apps) without explicitly calling "/data/magisk/XXXXX"
In a nutshell:
Code:
/sbin/su -> /data/magisk/su
/sbin/resetprop -> /data/magisk/resetprop
/sbin/magiskpolicy -> /data/magisk/magiskpolicy
/sbin/sepolicy-inject -> /data/magisk/magiskpolicy
/sbin/supolicy -> /data/magisk/magiskpolicy
/data/magisk/sepolicy-inject -> /data/magisk/magiskpolicy
New Boot Image Tool: MagiskBoot
I spent a lot of time rewriting the whole boot image patching tool. For now it shall GREATLY improve the compatibility of Magisk. Key features:
Complete rewrite boot image extracting process
Proper MTK header support
Sony ELF type boot image support
Native ramdisk compression method support : gzip, xz, lzma, bzip2, lz4
This means custom kernel developers can now use a different ramdisk compression method with their custom kernels!
Native cpio patching support: auto ramdisk backups, auto ramdisk restores, auto dm-verity patch, auto forencrypt patch, native cpio extract/mkdir/add
This means boot patching process itself does not require root access anymore (it usually does)
Native LG bump and Samsung SEANDROIDENFORCE flag detection
More Magisk installation methods shall come soon!
I believe some of the features above do not exist in any existing rooting methods, I hope this will bring more users on the Magisk bandwagon
MagiskSU Fixes
In all current open source root methods, a common issue is that some apps (most well-known: Titanium Backup) cannot properly mount /system to read-write. Here I'll only briefly explain the technical details.
After spending very many hours, the victims are narrowed down to programs that directly use the "mount" system calls instead of calling the "mount" command. Also, the issue does not only happens to /system, but instead any read-only partitions. The only way to remount them to rw is through the toybox implementation of the mount command, which should be the default of all devices. This means that any external mount command (e.g. busybox) cannot remount them to rw either. After digging through the AOSP toybox source code and some search through the commits, I finally found the culprit: this commit in AOSP. What that commit does in a nutshell is that all blocks mounted read-only will be locked to read-only.
So starting from this release of MagiskSU, all blocks will be unlocked when the daemon is started (this does NOT break your system integrity, meaning it does not break OTAs), everything should work fine.
Another subtle change is that the command "-cn" will not do anything starting from now. All root developers can call the "-cn" command on both SuperSU and MagiskSU, it shall work in both cases.
I had tried to add the "-cn" command in the previous release, which only exists in SuperSU, but it was not implemented correctly, and apps depending on it will not work correctly.
However, this "context switch" command is originally added to SuperSU due to the way it managed selinux back in the old days. The way I deal with selinux, starting from Magisk v7 (Chainfire switched to similar method in his latest beta) DOES NOT need any context change, as all root procedures and processes are running in a permissive domain (in Magisk's case it's a domain that allows everything, which is slightly different to permissive. This is because permissive does not work on Sammy)
Magic Mount Vendor Issues
In Magisk v11.1, devices with a separate vendor partition (newer Nexus devices) will fail to properly magic mount files in vendor, the most common issue is using the ViPER4Android Magisk module.
It is now fixed in v11.5
Module Template Update
The Magisk Module Template is now updated. All developers please adapt your modules to the newer version
An entry in module.prop called template now indicates the template version number.
In future Magisk Manager updates, it will only show the modules that are using the latest two versions of the template.
e.g. If the latest template version is v13, only v13 and v12 modules will be showed in the repo
This gives the time for developers to update their modules, but also enforcing them to adapt to newer scripts, so I don't need to support the old template formats.
I apologize that I was busy and didn't add the existing module requests, I'll add them once you have migrated your module to the latest template
Also please note that I will NOT add modules that ONLY change some props using resetprop, as this is a upcoming feature to Magisk Manager in the near future.
What's Next?
Magisk v11.1 got over 500K downloads! Thank you for all the support!
The next short term goal is to add more features into MagiskManager (including the mentioned prop management, and a new installation method)
The long term goal will be migrating the current script-based magic mount to C program, which shall be run as a daemon in the background, combining resetprop, magiskhide etc. all-in-one. This will take some time to finish though.
For the long awaited Pixel support, I think I'll start working on it, but the complexity of that device might take a very long time for me to understand, since I do not own the device. I can only borrow my friend's device for not that long of a period of time, so progress shall be really slow. I'll not get the Pixel device now, because I don't think it is worth the price and the hassle for me to import it into Taiwan, but I'll definitely get the Pixel 2 to replace my current daily driver lol.
Magisk v11.6 Hotfix
The issue turns out to be a veeeery minor issue, but causes the whole script unable to run correctly on Samsung devices.
Also, I fixed the incorrect value for selinux prop patching for MagiskHide, so people with selinux issues should now be settled.
I guarantee all future releases will go through serious beta testing, especially Samsung devices. This project is in a scale that these kind of mistakes cannot be tolerated.
I'm sorry for all the inconvenience the previous release gave you, and the mess and headaches for all broken devices.
The Module Template is again updated. This bug will also affect module templates, so please update accordingly, thanks!!
But still, I hope you will enjoy this new release
2017.3.31 Magisk V12.0
The major version bump should label this release as a stable release (at least this is what I hope)
This release is thoroughly tested by all my testers, especially focusing on Samsung devices
Unless major issues, the next release should be a complete new redesign, and requires more time, more info later
The FAQ in OP is updated, please check them out!!!
Samsung, Samsung, oh Samsung
My previous release was widely criticized for breaking tons of Samsung devices, the rating on Play Store also reflected this fact
Thanks to helpful testers and developers, we ironed out all the quirks of Sammy, and in addition added more Samsung specific features.
One is adding proper support for Samsung permissive kernels. Another is faking KNOX to 0x0 if MagiskHide enabled.
Is that good enough to compensate my mistakes in the last release?
Sepolicy Live Patch Moved
Another critical update is that the sepolicy live patching is now moved from the post-fs-data mode to the service mode.
This decision is done due to the fact that on some devices (e.g. Samsung), there are too much to patch, which greatly delays the bootup time if the live patching is done in a blocking stage. However, this will require some updates for the minimal sepolicy rules.
The minimal patch is now a little more complete, which requires 20-80KB of ramdisk size (previously 1-4KB). Still not large to be honest.
However, this makes post-fs-data mode NOT completely unrestricted. post-fs-data mode can still do any file related operations, setting system props etc., a lot more than normal users would use. However, service mode would be guaranteed to be executed AFTER the full sepolicy patch is done.
It is recommended to run most scripts in the service mode (service.d/service.sh), except a. mounting files; b. patching system props; c. time critical operations
Magisk Core Only Mode
People complain that Magisk has "too many features", they don't want to use such "complete" solution.
Here I introduce Core Only Mode. It can be enabled in the new Magisk Manager.
What will still be started: MagiskSU, post-fs-data.d, service.d, (if enabled: MagiskHide, systemless hosts, systemless busybox)
What will not be started: Cache (post-fs) mounts, magic mount (system mirror etc.), all modules, all module scripts
So it literally limits Magisk to root + boot scripts. MagiskHide is still there for those who want some Mario Run lol.
Say Goodbye to Outdated Modules
This day finally comes. All modules on the repo that aren't using the latest template (v3 for now) are now hidden.
This not only guarantees that the modules are using the latest scripts, but also a nice way to filter out modules that are no longer maintained by the uploader.
You have to add/update template=(ver) in your module.prop. Magisk Manager will not know if you only updated the scripts
Upcoming Features
Here are some planned features (sorted in priority)
Magisk Manager resetprop GUI
MagiskSU multiuser support
Unified Magisk daemon: As stated before, I'm planning to write Magic Mount in code to achieve more efficiency and features.
All current Magisk features (magiskpolicy, magiskhide, resetprop, superuser, magic mount) will be in a unified daemon
Pixel (XL): Some developers has done some progress, I'll contact them and sort things out
Android O: I bought a Nexus 5X now, finally got some O love
Some details are changed in v12.0, I'll update the documentation (wiki) soon.
Some Recent Updates
I wish I can be more vocal in the forums, so more information can be spread to the community, but being a university student in Taiwan, studying engineering specifically, is not easy.
It has been a while since the last release, I think I would shed some light regarding the next big update.
Unified Binary
First, the most obvious change is that Magisk no longer rely on the overly complicated scripts, but instead replaced with pure C/C++ programs. Along with Magisk's development, more and more features were added, and those cannot be done with scripts are added as binaries (magiskhide, magiskpolicy, resetprop etc.). As a result, in the last build (v12.0) there are tons of binaries scattered, loosely working together with poor communication.
So the first thing to do is to combine everything as a single program, something like busybox, which is a single binary that acts as multiple utilities. This took me quite some time to finish, especially merging the existing superuser with other parts that also requires daemon connection. Another tricky part is to port the spaghetti shell script into proper C code. The good news is that both of them are done (though, some small bugs might exist and I'm currently hunting them down)
No More Busybox!
Second is the decision to remove the bundled busybox. Initially I added busybox into Magisk due to lack of proper commandline tools in native Android environment (e.g. lack of losetup in Android 5.0), and also many selinux specific options for several utilities do not exist in official AOSP toolbox/toybox. The big problem is that the busybox causes more issues than I would ever expect. Many features in v12 are implemented to only work with that specific busybox bundled with Magisk. However due to the variety of configurations of custom roms, the assumption that the target busybox is always there, working as expected obviously isn't true, leading to numerous breakage and headaches. This is one of the reason why tons of issues submitted to Github are not addressed, because all pre-v13 are haunted with the same issue - the environment Magisk is running is a mess.
However, thanks to ditching shell scripts completely, currently I handle everything by natively calling system calls, or by implementing the functions directly into the binary (another tedious task...). So Magisk now works as a complete package itself, no more dependency and requirements in the environment. Due to this change, the Magisk Manager would need to include a busybox in order to provide the environment to install Magisk modules/Magisk updates, which I think many tracking the development on Github would already notice this change.
Those wondering how to add busybox if they want? I'll release a new module in the repo.
Android O
Finally, Android O support! As expected, Android O has quite some security changes, but since I'm gonna start everything from scratch anyway, things are all quickly sorted out. Also thanks to the arrival of my Nexus 5X, I can finally test things on an actual device, as a result Magisk is now 100% working on Android O DP1. The module template might need some slight updates regarding Android O changes, please stay tuned for the announcement!
Of course, tons of other improvements are also included, I won't list all of them here and will leave them for the release post and changelogs. Updates to Magisk Manager are also work in progress (application development is very tiresome...). There are still tons of features/support bugging in my mind and I would hope I can implement all, but the reality and school prevents me to do so, I am now aiming more towards a stable release rather than rushing out poorly designed features and making me regret in future maintenance lol.
I won't have time to publish lots of informative posts as this one, for those who are interested in the active development of Magisk/Magisk Manager, please keep track of the Github repos. I always keep the development work transparent, anyone curious can spend a little effort to build it themselves and have a sneak peak of what's currently going on. Just keep in mind that the cutting edge master branch does not always work properly