[Magisk14] Marshmallow: access denied when creating secure container - Magisk

Hello,
I'm using Magisk 14.0 on Marshmallow (Nvidia Shield tablet).
Some apk refuse to install: from the logcat, the vold is unable to create the secure container (asec) on the SD card.
When I enable the SELinux Permissive script, it then can install the apk (creating the .asec in /mnt/secure/asec I think), but then I don't pass safetynet.
Apparently, the vold (or another component related to the ASEC thing) doesn't have the correct contexts, I get access denied in logcat.
Code:
0-09 14:26:11.505 862 898 D VoldConnector: SND -> {10 asec create smdl1636995937.tmp 98 ext4 [scrubbed] 10005 1}
10-09 14:26:11.510 182 210 E Vold : Error creating imagefile (Permission denied)
10-09 14:26:11.510 182 210 E Vold : ASEC image file creation failed (Permission denied)
10-09 14:26:11.510 182 210 W Vold : Returning OperationFailed - no handler for errno 13
10-09 14:26:11.510 862 1714 D VoldConnector: RCV <- {400 10 asec operation failed (Permission denied)}
10-09 14:26:11.513 7320 7331 E PackageHelper: Failed to create secure container smdl1636995937.tmp
Anyone experienced it also ?
Laurent

For what it worths, I tested Magisk 14 on Lollipop (still on Nvidia Shield), and the "Move to SD" works as expected.
I'm wondering if the "Move to SD" is not broken on MarshMallow and Nougat.: but I've no clue why it tries to install the app on SDcard anyway.
As a workaround, I'd be interested in knowing if "install to external" can be completely disabled, so that even if the apk supports move to sd, it will still install on internal.
Any hint ?

Related

Move to SD Card - Couldn't move app. Not enough storage space.

Hi All,
I've just done a clean install (wipe data, system and caches) of CM12.1 (2015-09-06) on my Nook HD 8GB. I've also installed the Micro version of the OpenGapps and SuperSU - all working fine. When I signed in to Play Store it automtically installed some of the apps that I had previously installed - these are working ok as well. As this is the 8GB version of the NookHD I would like to move some larger apps to the external SD Card (on CM11 I used the swap SDCARD hack). In CM12.1 you now get the option to Move to SD Card on apps directly if you have an external sd card. If I click that button I get a message stating "Couldn't move app. Not enough storage space."
If I run logcat I get the following for this operation:
E/Vold ( 150): Error creating imagefile (Read-only file system)
E/Vold ( 150): ASEC image file creation failed (Read-only file system)
W/Vold ( 150): Returning OperationFailed - no handler for errno 30
E/PackageHelper( 2596): Failed to create secure container smdl1400276855.tmp
W/DefContainer( 2596): Failed to copy package at /data/app/com.midasplayer.apps.
bubblewitchsaga2-2
W/DefContainer( 2596): java.io.IOException: Failed to create container smdl14002
76855.tmp
W/DefContainer( 2596): at com.android.defcontainer.DefaultContainerService.copy
PackageToContainerInner(DefaultContainerService.java:327)
W/DefContainer( 2596): at com.android.defcontainer.DefaultContainerService.acce
ss$000(DefaultContainerService.java:67)
W/DefContainer( 2596): at com.android.defcontainer.DefaultContainerService$1.co
pyPackageToContainer(DefaultContainerService.java:108)
W/DefContainer( 2596): at com.android.internal.app.IMediaContainerService$Stub.
onTransact(IMediaContainerService.java:60)
W/DefContainer( 2596): at android.os.Binder.execTransact(Binder.java:446)
I/art ( 457): Explicit concurrent mark sweep GC freed 72685(4MB) AllocSpace
objects, 26(786KB) LOS objects, 33% free, 15MB/23MB, paused 1.708ms total 170.3
18ms
D/PackageManager( 457): Install result for move: INSTALL_FAILED_CONTAINER_ERROR
And then after running this once I get a lot of these messages
E/sdcard ( 126): opendir /data/media/0/Android/data/com.google.android.youtube
failed: Permission denied
E/sdcard ( 126): opendir /data/media/0/Android/data/com.google.android.youtube
failed: Permission denied
I/DefContainer-JNI( 2596): error opening: /data/media/0/Android/data/com.google.
android.youtube: Permission denied
I've had a look at the permissions of the above directory and to me they look ok:
ls -ls *youtube
total 8
drwxrwxr-x media_rw media_rw 2015-05-28 21:38 cache
drwxrwxr-x media_rw media_rw 2015-05-28 21:38 files
[email protected]:/data/media/0/Android/data #
Any ideas on this would be greatly appreciated.
Fix Permissions from recovery does not help.
Many thanks,
Herges
SD hack.
Hello I was wondering if you could help me find the SD swap for cm 11 on nook HD. Many thanks
zeidgesempai said:
Hello I was wondering if you could help me find the SD swap for cm 11 on nook HD. Many thanks
Click to expand...
Click to collapse
Please create a new thread in Q and A rather than ask here... thanks
Bump
Is there really nobody who is trying to move apps to SDCard on CM 12.1?
herges said:
Is there really nobody who is trying to move apps to SDCard on CM 12.1?
Click to expand...
Click to collapse
Samsung Galaxy S3 Mini+ CM12.1 and same problem. Last CFW is CM11.0 and movind apps to SDCard working perfectly. 13 GB free space and phone says: "Couldn't move app. Not enough storage space" I would be grateful if someone would be able to help.
Same problem here. Cm12.1 and note 3 tmobile.

Noob development question: avc permission denied { open } on zip file, Marshmallow

This question was also asked in StackOverflow by me. (http://stackoverflow.com/questions/34547745/android-marshmallow-new-file-gives-permission-denied)
My apologies if this has been asked, but the only articles/threads for SELinux explained the policies and didn't have a procedure on Android, OR were not for Android.
Currently writing an app where content (in a small zip file) is downloaded from an external location and stored inside /data/data/package_name_removed/user1/, to be read later.
I currently have a zip file in that directory "Test.zip".
A try-catch loop containing:
Code:
//where filename is Test.zip
//and userDir = "user1"
//and sourceContext is passed from the base Activity calling this class that does not inherit Activity
Log.d("Target file is", sourceContext.getFilesDir()+"/"+userDir +"/"+ fileName);
File file = new File(sourceContext.getFilesDir()+"/"+userDir +"/"+ fileName);
ZipFile loadedFile = new ZipFile(file);
Doesn't seem to work in Marshmallow:
Code:
D/Target file is: /data/data/package_name_removed/files/user1/Test.zip
W/package_name_removed: type=1400 audit(0.0:11699): avc: denied { open } for name="Test.zip" dev="mmcblk0p29" ino=57426 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:app_data_file:s0 tclass=file permissive=0
"avc" is a SELINUX error according to the documentation.
This is a Log.d of the IOException getMessage; I think this one's generated from the new File() statement:
Code:
D/Log_title_omitted: /data/data/package_name_removed/files/user1/Test.zip: open failed: EACCES (Permission denied)
I'm pretty sure I do not need READ/WRITE_EXTERNAL_STORAGE at this point as I'm in a directory that is the app's personal directory, which the app is supposed to have access to anyway.
I don't think I should change SELINUX to Permissive in order for this to work, I can't guarantee this flag is set on any other device but mine.
Any help here? Or is the procedure now to get write permissions to a location that isn't guaranteed to exist?
Answer found on StackOverflow:
Manually copying the file into the app's own data/data/package_name/ directory on a rooted device will not work if SELinux is "enforcing" - The app must own the file by "creating" it. Giving it r permissions across the board isn't enough.
No idea how this is for places requiring READ_EXTERNAL.
My solution involved creating a temporary http download service to pass the file along.

Found a fix for when Magisk Hide settings do not stick on reboot

I'm on a Moto G5 Plus stock systemlessly rooted with custom kernel.
I noticed in the Magisk logs that the app was unable to write to /magisk/.core/hidelist -- That's because the subfolder simply wasn't there. The exact error was pretty obvious in the logs: fopen: /magisk/.core/magiskhide/hidelist failed with 2: No such file or directory
So I created a new folder and set the permissions on it to rwxr-xr-x
Now when I set my list of apps to hide, it sticks on reboot.
I'm not sure why it doesn't get created in the first place. Other modules seem to be downloaded and written to /magisk just fine. Oh well. Hope this helps out some other people.
Thanks. Guess this works.
Can you please elaborate?
dunderball said:
I'm on a Moto G5 Plus stock systemlessly rooted with custom kernel.
I noticed in the Magisk logs that the app was unable to write to /magisk/.core/hidelist -- That's because the subfolder simply wasn't there. The exact error was pretty obvious in the logs: fopen: /magisk/.core/magiskhide/hidelist failed with 2: No such file or directory
So I created a new folder and set the permissions on it to rwxr-xr-x
Now when I set my list of apps to hide, it sticks on reboot.
I'm not sure why it doesn't get created in the first place. Other modules seem to be downloaded and written to /magisk just fine. Oh well. Hope this helps out some other people.
Click to expand...
Click to collapse
Hi,
Can you please elaborate the steps. Sorry, I'm a noob. Where to create a new folder? How to set the permissions on it? to rwxr-xr-x ?
Thanks.
Clarification: "hidelist" is not a folder but a file (under /sbin/.core/img/.core) containing the apps and processes added to the MagiskHide list. The default permissions for the file is rw-rw-rw (666).
Not sure why a folder worked for the OP...
@sghegde87 If you can't get MagiskHide to work and you see the above mentioned errors, use a root capable file explorer and navigate to /sbin/.core/img/.core (make sure the setting to view hidden files and folders is enabled, or you won't see the .core directories). Create an empty file named hidelist (no extension) and then give it the above mentioned permission (666). In most file explorers you can do this by long-pressing the file and go to "details" or similar. Depends on the file explorer... I always recommend FX File Explorer.
Thanks for the quick response but..
Didgeridoohan said:
Clarification: "hidelist" is not a folder but a file (under /sbin/.core/img/.core) containing the apps and processes added to the MagiskHide list. The default permissions for the file is rw-rw-rw (666).
Not sure why a folder worked for the OP...
@sghegde87 If you can't get MagiskHide to work and you see the above mentioned errors, use a root capable file explorer and navigate to /sbin/.core/img/.core (make sure the setting to view hidden files and folders is enabled, or you won't see the .core directories). Create an empty file named hidelist (no extension) and then give it the above mentioned permission (666). In most file explorers you can do this by long-pressing the file and go to "details" or similar. Depends on the file explorer... I always recommend FX File Explorer.
Click to expand...
Click to collapse
@Didgeridoohan:- Thank you for the quick reply and detailed description. Here is what happened:- There is already a file name 'hidelist' in /sbin/.core/img/.core directory. So, I deleted it and created a new one and set the permission to 666.
I added all the apps that has to be magiskhide. I checked this hidelist file and it is updated accordingly after I tick the apps in Magisk manager.
However, after reboot, again, the apps preference is reset.. All hide settings are reset. Below is the Log file from Magisk after reboot if that helps.
Any idea what might be causing this issue?
Device:- Lenovo P2 with Stock rom_S251 - Rooted via Magisk.
Code:
02-14 15:51:58.289 437 437 I Magisk : Magisk v16.0(1600) daemon started
02-14 15:51:58.298 437 442 I Magisk : ** post-fs mode running
02-14 15:52:01.565 437 682 I Magisk : ** post-fs-data mode running
02-14 21:22:01.571 437 682 I Magisk : * Creating /sbin overlay
02-14 21:22:01.572 437 682 I Magisk : * Mounting mirrors
02-14 21:22:01.573 437 682 I Magisk : mount: /sbin/.core/mirror/system
02-14 21:22:01.573 437 682 I Magisk : link: /sbin/.core/mirror/vendor
02-14 21:22:01.574 437 682 I Magisk : bind_mount: /sbin/.core/mirror/bin
02-14 21:22:01.574 437 682 I Magisk : * Setting up internal busybox
02-14 21:22:01.586 437 682 I Magisk : * Mounting /data/adb/magisk.img
02-14 21:22:01.598 437 682 E Magisk : mount /dev/block/loop0->/sbin/.core/img failed with 22: Invalid argument
02-14 21:22:01.598 437 682 E Magisk : umount /sbin/.core/img failed with 22: Invalid argument
02-14 21:22:01.608 437 682 I Magisk : Resize /data/adb/magisk.img to -1854921600M
02-14 21:22:01.637 437 682 I Magisk : Create /data/adb/tmp.img with size -1854921600M
02-14 21:22:01.660 437 682 E Magisk : mount /dev/block/loop0->/dev/source failed with 22: Invalid argument
02-14 21:22:01.670 437 682 E Magisk : mount /dev/block/loop1->/sbin/.core/img failed with 22: Invalid argument
02-14 21:22:01.670 437 682 I Magisk : * Running post-fs-data.d scripts
02-14 21:22:01.671 437 682 I Magisk : * Running module post-fs-data scripts
02-14 21:22:01.671 437 682 I Magisk : * Loading modules
02-14 21:22:01.671 437 695 I Magisk : * Starting MagiskHide
02-14 21:22:01.671 437 695 I Magisk : hide_utils: Hiding sensitive props
02-14 21:22:01.671 437 695 E Magisk : fopen: /sbin/.core/img/.core/hidelist failed with 2: No such file or directory
02-14 21:22:01.671 437 695 I Magisk : hide_list add: [com.google.android.gms.unstable]
02-14 21:22:01.691 437 695 I Magisk : proc_monitor: init ns=mnt:[4026531840]
02-14 21:22:01.813 437 755 I Magisk : ** late_start service mode running
02-14 21:22:01.814 437 755 I Magisk : * Running service.d scripts
02-14 21:22:01.814 437 755 I Magisk : * Running module service scripts
02-14 21:22:03.538 437 695 I Magisk : proc_monitor: zygote ns=mnt:[4026533676] zygote64 ns=mnt:[4026533675]
03-06 12:56:00.383 437 695 I Magisk : proc_monitor: com.google.android.gms.unstable (PID=4625 ns=mnt:[4026533848])
03-06 12:56:24.289 437 695 I Magisk : proc_monitor: com.google.android.gms.unstable (PID=6244 ns=mnt:[4026533862])
sghegde87 said:
@Didgeridoohan:- Thank you for the quick reply and detailed description. Here is what happened:- There is already a file name 'hidelist' in /sbin/.core/img/.core directory. So, I deleted it and created a new one and set the permission to 666.
I added all the apps that has to be magiskhide. I checked this hidelist file and it is updated accordingly after I tick the apps in Magisk manager.
However, after reboot, again, the apps preference is reset.. All hide settings are reset. Below is the Log file from Magisk after reboot if that helps.
Any idea what might be causing this issue?
Device:- Lenovo P2 with Stock rom_S251 - Rooted via Magisk
Click to expand...
Click to collapse
All I can say is that you've got some kind of loop mount issue...
What's the output when you run the mount command in a terminal emulator?
Yes you are right.
Didgeridoohan said:
All I can say is that you've got some kind of loop mount issue...
What's the output when you run the mount command in a terminal emulator?
Click to expand...
Click to collapse
Yep. It's a mount issue. The problem was F2FS data partition. I formatted it to EXT4 and everything is working just fine. Magisk works as expected only on EXT4 format type in Lenovo P2 stock ROM.
Thanks for the comment though!
I'm using stock Note 3 (N9005DXSGBQA1) and followed instructions for magisk manager. I got it rooted but magiskhide does NOT work - NOT SAVING ANY SELECTION.
I tried using "core only" and tried inserting a new hidelist but both failed. I badly need the hidelist feature. How can I make magiskhide work? Thanks
hidelist deleted
It's not working on my Nexus 7 2013 deb tablet. Rebooting deletes hidelist. Please help. Thanks
jhford said:
It's not working on my Nexus 7 2013 deb tablet. Rebooting deletes hidelist. Please help. Thanks
Click to expand...
Click to collapse
This workaround was for devices with f2fs issues, in late 2017. Your device don't use f2fs (normally) and much use happened with Magisk since (the hidelist file is no longer used, as an example).
100% sure you've got something else going on (unless you're on a really old Magisk release).
Didgeridoohan said:
This workaround was for devices with f2fs issues, in late 2017. Your device don't use f2fs (normally) and much use happened with Magisk since (the hidelist file is no longer used, as an example).
100% sure you've got something else going on (unless you're on a really old Magisk release).
Click to expand...
Click to collapse
My problem is that the Spectrum TV app will not run on a rooted device. So, I use Magisk Hide, but Safetynet fails on each reboot. So, the temporary fix is to untick Hide in Settings, reboot, retick hide, rerun Safetynet, which always passes, and Spectrum TV app also works. PITA. Do you know of a permanent solution?
Thanks
jhford said:
My problem is that the Spectrum TV app will not run on a rooted device. So, I use Magisk Hide, but Safetynet fails on each reboot. So, the temporary fix is to untick Hide in Settings, reboot, retick hide, rerun Safetynet, which always passes, and Spectrum TV app also works. PITA. Do you know of a permanent solution?
Thanks
Click to expand...
Click to collapse
That just means things aren't working as intended on your device. More info is needed:
https://www.didgeridoohan.com/magisk/MagiskHideHelp
Didgeridoohan said:
That just means things aren't working as intended on your device. More info is needed:
https://www.didgeridoohan.com/magisk/MagiskHideHelp
Click to expand...
Click to collapse
My Magisk log is attached.
jhford said:
My Magisk log is attached.
Click to expand...
Click to collapse
Update. I uninstalled Magisk manager and installed the Canary version, but the problem remains. Neither Safetynet nor Magisk Hide work unless I do the following: disable Magisk Hide, reboot, and enable Magisk Hide. I'm glad it works, at least, but the rebooting is a PITA.

Need Belutooth partition backup of Moto one power device having January 1st Patch

Hi all,
Can anybody please share the twrp backup of bluetooth partition of Moto One Power device having the Pie January 1st Patch? My bluetooth partition got formatted while restoring the twrp backup and restore got failed. Now I'm not able to use the bluetooth. I have got the OTA with face unlock, But thile installing the OTA I started getting bluetooth partition block verification failed saying partition got mounted rw. And while restoring the earlier backup it got formatted :crying:
Got it fixed after a hell lot of research
Hi all,
Finally after searching a lot in net, flashed the bluetooth partition with the img file available in the following site ( Phenotypically ) -> mirrors[dot]lolinet[dot]com[slash]firmware[slash]moto[slash]chef[slash]official[slash]RETIN
The root cause for getting the partition formatted is gettiing the following error, to solve it I tried to restore bluetooth partition and it resulted currupt. Hope it may help somebody who will be get the same issue and stumble upon this page.
I was getting "Update Failed" error in Moto updator. While checking for the logs via adb observed the following error :
Code:
update_engine: [0306/081413.872062:INFO:delta_performer.cc(397)] Applying 8 operations to partition "bluetooth"
update_engine: [0306/081413.885946:ERROR:fec_file_descriptor.cc(30)] No ECC data in the passed file
update_engine: [0306/081413.886903:ERROR:delta_performer.cc(432)] Unable to open ECC source partition bluetooth on slot A, file /dev/block/bootdevice/by-name/bluetooth_a: Success
update_engine: [0306/081413.887044:ERROR:delta_performer.cc(1042)] The hash of the source data on disk for this operation doesn't match the expected value. This could mean that the delta update payload was targeted for another version, or that the source partition was modified after it was installed, for example, by mounting a filesystem.
update_engine: [0306/081413.887251:ERROR:delta_performer.cc(1047)] Expected: sha256|hex = 9F69430D4BED82B26E49AAA81E0F1E823687605099AD61F45A361A96E7BE6FEE
update_engine: [0306/081413.887321:ERROR:delta_performer.cc(1050)] Calculated: sha256|hex = 734059C0A03A2B2E61CBF3302F2982F3811FD243064D434A6CFC0FAEBDBC0E85
update_engine: [0306/081413.887393:ERROR:delta_performer.cc(1061)] Operation source (offset:size) in blocks: 0:1,6:2,34:1,101:30
update_engine: [0306/081413.887487:WARNING:mount_history.cc(66)] Device was remounted R/W 1 times. Last remount happened on 2019-03-05 03:36:34.000 UTC.
update_engine: [0306/081413.887573:ERROR:delta_performer.cc(1340)] source_fd != nullptr failed.
update_engine: [0306/081413.887652:ERROR:delta_performer.cc(301)] Failed to perform BROTLI_BSDIFF operation 4604, which is the operation 0 in partition "bluetooth"
update_engine: [0306/081413.887721:ERROR:download_action.cc(337)] Error ErrorCode::kDownloadStateInitializationError (20) in DeltaPerformer's Write method when processing the received payload -- Terminating processing
update_engine: [0306/081413.888372:INFO:delta_performer.cc(317)] Discarding 301 unused downloaded bytes
update_engine: [0306/081413.894845:INFO:multi_range_http_fetcher.cc(172)] Received transfer terminated.
update_engine: [0306/081413.895113:INFO:multi_range_http_fetcher.cc(124)] TransferEnded w/ code 206
update_engine: [0306/081413.895166:INFO:multi_range_http_fetcher.cc(126)] Terminating.
update_engine: [0306/081413.895224:INFO:action_processor.cc(116)] ActionProcessor: finished DownloadAction with code ErrorCode::kDownloadStateInitializationError
update_engine: [0306/081413.895278:INFO:action_processor.cc(121)] ActionProcessor: Aborting processing due to failure.
Since Moto One Power is having A/B Partition and seemless update support, It looks like the incremental security update was checking for the checksum of the corresponding partition before applying the incremental update. To fix this I flashed the bluetooth and other failing partitions with the apropriate images available in the above shared link.
Hi there, i'm facing the same issue. Can u please tell me which img to flash from stock firmware?

decryption fails after TWRP restore

I've just tried to dirty flash an update, which failed, so restored a backup I made prior, restoring system, vendor, data and boot partitions. Now the phone doesn't boot properly and after looking at the boot logcat it looks like the cause is that the decryption fails-
Code:
06-25 21:03:43.257 2128 2152 D StorageManagerService: unlockUserKey: 0 isFileEncryptedNativeOrEmulated: true hasToken: false hasSecret: false
06-25 21:03:43.257 602 602 D vold : fscrypt_unlock_user_key 0 serial=0 token_present=0
06-25 21:03:43.259 602 602 D vold : Skipping non-key .
06-25 21:03:43.259 602 602 D vold : Skipping non-key ..
06-25 21:03:43.259 602 602 D vold : Trying user CE key /data/misc/vold/user_keys/ce/0/current
06-25 21:03:43.253 0 0 I init : processing action (sys.boot_completed=1) from (/system/etc/init/hw/init.rc:978)
06-25 21:03:43.253 0 0 I init : starting service 'exec 25 (/bin/rm -rf /data/per_boot)'...
06-25 21:03:43.256 0 0 I init : SVC_EXEC service 'exec 25 (/bin/rm -rf /data/per_boot)' pid 3944 (uid 1000 gid 1000+0 context default) started; waiting...
06-25 21:03:43.264 577 577 I hwservicemanager: getTransport: Cannot find entry [email protected]::IKeymasterDevice/default in either framework or device manifest.
06-25 21:03:43.264 602 602 I vold : List of Keymaster HALs found:
06-25 21:03:43.264 602 602 I vold : Keymaster HAL #1: Keymaster HAL: 4 from QTI SecurityLevel: TRUSTED_ENVIRONMENT HAL: [email protected]::IKeymasterDevice/default
06-25 21:03:43.264 602 602 I vold : Using Keymaster HAL: 4 from QTI for encryption. Security level: TRUSTED_ENVIRONMENT, HAL: [email protected]::IKeymasterDevice/default
06-25 21:03:43.264 602 602 E vold : Failed to read from /data/misc/vold/user_keys/ce/0/current/keymaster_key_blob: No such file or directory
06-25 21:03:43.264 602 602 E vold : Failed to find working ce key for user 0
06-25 21:03:43.264 602 602 E vold : Couldn't read key for 0
06-25 21:03:43.265 2128 2152 E StorageManagerService: android.os.ServiceSpecificException: (code 0)
Strangely though, twrp can decrypt the data partition just fine.
And also, I don't really get why after restoring from a backup this would happen, I thought that essentially the phone state would basically be the same as before I did the backup after restoring, provided I don't format data or mess with the fs in any other way. Does anyone know why this might happen and could explain to me?

Categories

Resources