[ROOT]Gaining write access on system partition

[njhuiz]

The latest update to .368 restricts access to /system, in particular 'mount -o remount,rw /system' won't give write access.

With the SuperSU 'supolicy' tool and a current busybox there is an easy way around the protection:

/system/xbin/supolicy --live \
  "allow init_shell unlabeled file {execute execute_no_trans}"\
  "allow  {init_shell kernel} {device unlabeled mmc_block_device} blk_file {getattr read write open ioctl}"\
  "allow init_shell kernel process setsched"\
  "allow init_shell {rootfs labeledfs} filesystem {mount umount remount}"

mknod /dev/loop2 b 7 2
losetup /dev/loop2 /dev/block/mmcblk0 -o 96468992
mount -t ext4 /dev/loop2 /system

The number in the losetup command is the position of the system partition in bytes in the internal memory. (This number in blocks (bytes = blocks * 512) is displayed in the expert mode of fdisk)

This works because we do not use the device corresponding to the system partition but construct an equivalent device.

 

[SXUsr]

Chainfires adbd Insecure app. Try the app first but if you still can't mount and push files read this thread - [HOW TO]Make your favorite kernel adbd insecure to run ADB as root on /system

I can now just adb remount and have access to the system.

 

[njhuiz]

I could not write to /system because I somehow lost the XZDualRecovery during the last update. When installed that does the magic at startup and enables a "remount,rw" of /system. In particular it has nothing to do with .368 as I initially suspected.

The flashable zip of the XZDualRecovery contains the necessary scripts and modules.

The method proposed in my initial post has the advantage, that it builds on (heavily used) features of the (Linux) kernel and is independent of the kernel version. Kernel modules on the other hand often only work with the kernel they were compiled for.

 

[levone1]

Far from an expert, so please let me know what I'm missing. Ran all commands successfully, rebooted, but still seems like no system rw access. Does this actually create that access, or does this only enable the ability to get access, and now there's another step? Thanks

 

[njhuiz]

Those commands grant immediate write access, but this is not persistent.
If you need a persistent solution, you should install the XZDualrecovery (which you should do anyway!).
Then a "mount -o remount,rw /system" gives you write access.

 

[levone1]

Those commands grant immediate write access, but this is not persistent.
If you need a persistent solution, you should install the XZDualrecovery (which you should do anyway!).
Then a "mount -o remount,rw /system" gives you write access.

Thanks, I'll give it a try, (switched ROMs at the moment, but not for long).

 

[FrikandelChris]

I have an unlocked Bootloader, root (working!) and XZDualRecovery. I' running prerooted 5.1 Android Stock ROM. I can't write to system... I tried many commands via ADB.
Is there any workaround?

 

[SXUsr]

I have an unlocked Bootloader, root (working!) and XZDualRecovery. I' running prerooted 5.1 Android Stock ROM. I can't write to system... I tried many commands via ADB.
Is there any workaround?

This works for me - [2014.11.10][ROOT] adbd Insecure v2.00, install it, tick Enable insecure adb, then run...

[B]adb remount[/B]

...and that should allow you.

 

[njhuiz]

mount -o remount,rw /system

Works for me on 5.1 with XZDualRecovery installed (locked BL, Xposed installed, Linux adb host).

 

[tracyn]

I just spent a long time trying to get write access on my Z1C, too. I'm on MX ROM and wanted to debloat some of the software.

Turns out I just had to set the SE Linux from Enforced to Permissive, then using the mount -o remount,rw /system went fine.

su -c setenforce 0
mount -o remount,rw /system
exit

EDIT:
The "su -c setenforce 0" should make the change to Permissive permanent. Will check.

EDIT 2:
I had to get the app SELinuxModeChanger (http://forum.xda-developers.com/showthread.php?t=2524485) in conjunction with the adbd Insecure app to finally get it to work reliably, now...

 

[xander59]

I tried all the solution in this post but I failed every time... Someone to explain me how I have to do?

Envoyé de mon D5503 en utilisant Tapatalk

 

[levone1]

I tried all the solution in this post but I failed every time... Someone to explain me how I have to do?

Envoyé de mon D5503 en utilisant Tapatalk

Did you try all of them, (terminal commands in op, adb insecure app, mount -o remount command, selinux permission change..)? If so, and you still can't rw, I'd say it might be a problem with your ROM. I have used RockZ1 and MX ROM recently, and initially had issues, but at least one of these things worked for me.

 

[xander59]

In fact, I read again the topic and I have the version 21 of dual recovery, so I have the r/w permission... But i can't still see an app when I'm moving its to /system/app and set right permission

Envoyé de mon D5503 en utilisant Tapatalk

 

[njhuiz]

With a root browser or a terminal app you should be able so see all files... which app did you use?

 

[levone1]

In fact, I read again the topic and I have the version 21 of dual recovery, so I have the r/w permission... But i can't still see an app when I'm moving its to /system/app and set right permission

Envoyé de mon D5503 en utilisant Tapatalk

Not sure about that... I've definitely had apps that won't install or won't open before. I'm not sure what makes something compatible or not. Maybe email developer.

 

[xander59]

It was an issue to kill the app before moving it to system app

Envoyé de mon D5503 en utilisant Tapatalk

 

[Morfarj]

SGP621-RICDefeat

The SGP621-RICDefeat.zip will work on latest .216 stock. It's not a flashable zip but it contains a install.bat file, wich will remove the write to system protection. Then you can download an app from play store to mount system as RW and RO.

Don't remember where i found it though, but it was somewhere in the Z1 compact forum.

 

[SSyar]

This works for me - [2014.11.10][ROOT] adbd Insecure v2.00, install it, tick Enable insecure adb, then run...

[B]adb remount[/B]

...and that should allow you.

well when i try to tick the enable insecure adb it says could not patch,,
i am currently on 14.6.A.1.236

 

[SSyar]

ok well kingroot saves the day.,

 

[Morfarj]

Look at this. Worked for me. Very easy. http://forum.xda-developers.com/z3-...-sgp621-lollipop-23-1-0-690-noba-ftf-t3058400