How does Android SuperUser app detect that an app requests root?

Question

I'm writing an app that will use su to execute some commands in the linux kernel. I was wondering how SuperUser figures out that the application is asking for root privileges ? Also, are there any known ways (through obfuscation) in which this check can be bypassed ?

In other words: How does Android/(SuperUser) know that an app requires root privileges despite the fact that there are no permissions explicitly requested in the android manifest file.

I'm asking this question from a security standpoint. I want to know the details of how this works in order to be sure that a malicious app cannot bypass SuperUser.

Answer 1

There are two parts to the superuser system - the superuser binary (su on the terminal) and the SuperUser.apk (Android app to manage apps using su). Looking at the source code of the su binary, when you request su access through

Process p = Runtime.getRuntime().exec("su");

it publishes an intent through the android messaging manager that an application has requested for superuser access.

sprintf(command, "/system/bin/am broadcast -a '%s' --es socket '%s' --ei caller_uid '%d' --ei allow '%d' --ei version_code '%d' > /dev/null",action, socket_path, ctx->from.uid, allow, VERSION_CODE);  

The manager app listens for this intent and asks the user to handle the request (allow/deny).

Answer 2

When you run this:

Process p = Runtime.getRuntime().exec("su");

You are trying to execute "su" which only an app with superuser permissions can do! So whenever Android detects that you are trying to run "su" It will get that the App will need superuser permissions.

Also, Android has some area reserved which only Android system can access. If your app is trying to access something there, Android will understand that superuser is needed.

For example, say you are trying to modify the host file or modify some network configurations like DHCP. Or you are trying to access files from system area e.g. /data Android will check if the app has superuser permissions, and then only will grant it access to such things.

About malicious software, whenever an app needs superuser access, system will prompt user to grant or deny superuser permissions to the app. Only then the app can get root access. So it's up to the user to decide, whether to accept or deny root access for any app. (System will prompt user every time an app is trying to access something that needs root access, UNLESS you tell system to remember your choice of acceptance or denial for a particular app.)

PS: You might consider checking out website for Superuser app.