Let it be known that I barely understand what setuid/setgid/whatever is. I think it has something to do with what user a program is executed as. This brings me to nosuid.

In Security Enhancements in Android 4.3, Google says

The /system partition is now mounted nosuid for zygote-spawned processes,
preventing Android applications from executing setuid programs.

It makes no sense to me to say that a filesystem in Linux is mounted "for" anything, as if the way it is mounted can be relative to a process or executable. If the system partition on Android devices is mounted with nosuid, then how can any of the system's core executables run as root, which they need to do in the earliest stages of startup?

Possibly relevant line earlier in the same document:

No setuid/setgid programs. Added support for filesystem capabilities to Android system files and removed all setuid/setguid programs. This reduces root attack surface and the likelihood of potential security vulnerabilities.

Regarding your final question:

If the system partition on Android devices is mounted with nosuid, then how can any of the system's core executables run as root, which they need to do in the earliest stages of startup?

nosuid doesn't prevent root from running processes. It is not the same as noexec. It just prevents the suid bit on executables from taking effect, which by definition means that a user cannot then run an application that would have permission to do things that the user doesn't have permission to do himself.

Also relevant here is an understanding of what "zygote" actually is; try reading https://android.stackexchange.com/a/77308

Disclaimer: I'm not an Android expert.

  • So it's like disabling sudo? – Melab Dec 21 '15 at 23:15
  • 2
    Yes, similar. sudo itself has its suid bit set, as you can see by running ls -l $(which sudo). Another common suid utility is passwd; it has to run with root permissions so it can edit /etc/passwd. Note that suid doesn't actually mean "run with root permissions"; it means "run with the permissions of the executable's owner rather than the permissions of the user who runs the executable." However, the most common suid executables you see are owned by root. – Wildcard Dec 21 '15 at 23:20
  • 1
    To play with suid settings on your own box, you can run cp /bin/ls /tmp/ ; sudo chown someuser /tmp/ls ; sudo chmod 4755 /tmp/ls ; /tmp/ls ~someuser You'll be able to list the contents of someuser's home directory, because the modified copy of the ls binary runs with someuser's permissions rather than yours (with no sudo required). And, if you try /tmp/ls ~ you will get "permission denied" because someuser doesn't have permissions to list your home directory. – Wildcard Dec 21 '15 at 23:24

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.