I've booted Linux from NFS with Android system. And now I have to execute command as super use in minicom. But system doesn't allow me to switch to super user mode. Every time when I type:

shell@blaze_tablet:/ $ su   

I see:

su: permission denied

There is parameter at bootargs I've added in u-boot androidboot.selinux=disabled wich I thought would help. But it doesn't. Can problem be with permission to some files on NFS? Or I missed any parameter in bootargs?


The content of my /etc/exports file

# /etc/exports: the access control list for filesystems which may be exported
#       to NFS clients.  See exports(5).
# Example for NFSv2 and NFSv3:
# /srv/homes       hostname1(rw,sync,no_subtree_check) hostname2(ro,sync,no_subtree_check)
# Example for NFSv4:
# /srv/nfs4        gss/krb5i(rw,sync,fsid=0,crossmnt,no_subtree_check)
# /srv/nfs4/homes  gss/krb5i(rw,sync,no_subtree_check)
/export/rfs    *(rw,nohide,insecure,no_subtree_check,async,no_root_squash)
  • this may help unix.stackexchange.com/questions/61876/… – Ijaz Ahmad Khan Jun 27 '16 at 10:23
  • @IjazKhan, thank you for help. But system on my device doesn't have folder named pam.d, I can find it only on my host laptop Ubuntu system. Instructions from the best answer don't help too. System doesn't know command groups. When I type command su system doesn't request password. I can't find bin/su but I have xbin/su with required permissions. If I will boot system on device without NFS using internal system and rootfs partitions command su executes normally. In kernel menuconfig I didn't find grsecurity. I haven't looked in error logs yet, but I will do it now. – Dropper Jun 27 '16 at 11:00
  • Can you provide the result of ls -l for the su executable (ls -l $(type -p su), or whatever works for your shell) please – roaima Jun 29 '16 at 8:28
  • You did run exportfs -var on the NFS server after updating /etc/exports? (Or restart the server.) – roaima Jun 29 '16 at 8:30
  • 1
    you are missing the +s bit on the file, run chmod u+s /path/to/su to fix it – Rabin Jun 29 '16 at 8:55

You wrote:

result of execution of ls -l $(type -p su)

-rwxr-xr-x root root 157400 2016-04-21 19:11 su

There's your problem. su is missing the setuid root bit. The permissions should look like this:

-rwsr-xr-x 1 root root 40040 Nov 12  2015 /bin/su

There are three possibilities for this situation.

  1. The su executable on the server is not setuid (check with ls -l $(type -p su) on the server)
  2. The NFS mount on the client does not include - or explicitly excludes - the setuid bit. Ensure you don't have nosuid on your mount command, and if in doubt add suid as an explicit option
  3. Android security is implemented completely differently to Unix/Linux security. If this is the case I can't help you further
| improve this answer | |

Typically this happens if the NFS share isn't exported properly.

By default, the root user is mapped to nobody. This means that when you try and run su (which is suid root) then you will try to access files on the NFS server as user nobody... and this won't let you read /etc/shadow and similar.

You didn't say what your NFS server is, but if it's the normal Linux one then you need to add no_root_squash to the export.


/directory client(rw,no_root_squash,async,insecure)

Now the root user will access the files as if it was uid 0, and so can read the protected files.

| improve this answer | |
  • thank you for answer. But my file ` /etc/exports` already contains all required parameters that your wrote. I found one useless parameter, but it has no effect. – Dropper Jun 27 '16 at 13:00
  • @roaima, I've updated my question with content of my /etc/exports file. Useless parameter is nohide – Dropper Jun 29 '16 at 7:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.