Is it impossible to run as `root` if the machine isn't rooted?

Question

By default, the user of the device does not have access to certain root objects (e.g. the /data directory). Even though these objects are off-limits, however, it would seem to me that these objects are there for a reason; some process that runs as root eventually to access these objects, or else why would they exist.

But I have little experience with UNIX and Android and wanted to ask to make sure: Can the root user run on an Android device which hasn't been "rooted"? In which cases can a process initiate a root-level action? (e.g. OS updates?). Must the root password be provided in all cases?

Although I would try to answer this question myself, all things "UNIX" and "Android" looks like a lot to read, and I am not sure where I would find the answer to my specific question.

Answer 1

Certain programs and services run from /system on Android run as root - some rooting techniques involve injecting a command to remount /system into these 'programs'. Without the /system being mounted rw, there is no way for an added program to run as root. As far as /data, each app is given its own user id, and the /data/data folders where data for the app is stored is given permissions such that only that user is allowed any access (basically chmod 700). Of course, it takes a root level process to create this, which is again, run from the /system.

Answer 2

Your first assumption is not necessarily true as the "objects" or to be more precise files or executables can have these permissions just so they can not be executed or read by the normal user/process but with that being said there are multiple processes on an android Phone running with root privileges.

I think it is very important to understand that Android is only a Linux system underneath, i.e. everything you see on a Phone has not much in common with a Linux System like Ubuntu or Fedora, i.e. you can't just run a command as root with most stock Android images installed on real hardware. There is also no need at all to enter a root password (as far as i know android doesn't have a root password set) as Android was not a multi user system.

As you already have a normal user on your phone it may be possible to exploit/attack the system itself to gain root privileges, this was for example done successfully for older Android systems like 2.1.

I think you should have a look at the How do I root my Android device question, it may help to simplify and explain some things.

Answer 3

To root a device means to be able to run arbitrary programs as root. So by definition, if the machine isn't rooted, you can't run programs as root. There are programs running as root on an Android device. But you can't control what they do.

Android is not a unix operating system. The kernel is the same as Linux, but the rest is different. As far as the kernel is concerned, there are only three ways to run a program as root:

• It may be invoked by the kernel directly. When the kernel has finished booting, it invokes the init program as root. Connecting a device may also cause the kernel to run a program as root in some configurations.
• It may be invoked by a program that is itself running as root.
• It may be a setuid executable belonging to root.

On a unix system, programs like su and sudo are setuid root. They can be invoked by any user, and they decide (based on who calls them, what password they enter and so on) whether to run a shell or other program as root or return an error status. It's these programs, not the kernel, that performs authorization. The kernel only manipulates numerical user IDs, it doesn't handle user accounts and passwords.

A standard Android system doesn't have any user accounts (user IDs are used to isolate applications, not to isolate users). It doesn't use password-based authorization in the unix sense (it can use a PIN or other authentication method to authenticate the sole user of the system). To root an Android device means to arrange for some shell to run as root, typically to get adb shell to give you a shell running as root. There's still no root password, since there's a single user of the device.