How does Magisk on Android work as su without setuid and capabilities?

Question

I've read in another answer that on Android the su binaries avoid needing to be setuid by using filesystem capabilities like cap_setuid. But then I tried to check this, and to my surprise, I found no capabilities set on my Magisk-enabled Android 8.0 system.

Here's how I checked:

1. Logged in via SimpleSSHD
2. scp'ed the following binaries taken from Debian arm64 packages libcap2, libcap2-bin and libc6:
   • getcap
   • libc.so.6
   • libcap.so.2.25
   • libcap.so.2
   • ld-2.27.so
3. Had the following terminal session on the phone:

$ su
# whoami
root
# exit

$ type su
su is /sbin/su

$ ls -lh /sbin/su
lrwxrwxrwx 1 root root 12 2018-08-12 22:40 /sbin/su -> /sbin/magisk

$ ls -lh /sbin/magisk
-rwxr-xr-x 1 root root 94 2018-08-12 22:40 /sbin/magisk

$ sed 's@^@> @' /sbin/magisk
> #!/system/bin/sh
> unset LD_LIBRARY_PATH
> unset LD_PRELOAD
> exec /sbin/magisk.bin "${0##*/}" "$@"

$ ls -lh /sbin/magisk.bin
-rwxr-xr-x 1 root root 71K 2018-08-12 22:40 /sbin/magisk.bin

$ file /sbin/magisk.bin
/sbin/magisk.bin: ELF shared object, 32-bit LSB arm, dynamic (/system/bin/linker), stripped

$ LD_LIBRARY_PATH=. ./ld-2.27.so ./getcap -v /sbin/magisk.bin
/sbin/magisk.bin

As you can see, neither setuid bit, nor any capabilities are present in the /sbin/magisk.bin binary. So what's going on? How does it work?

Answer 1

It appears that /sbin/magisk.bin the non-root user launches doesn't spawn the root shell by itself. Instead, it communicates its request to magiskd, which is executed as root. And magiskd, after checking for permissions, executes the command requested. (Interestingly, magiskd is the same binary – /sbin/magisk.bin, but run by init as root).

You can check this as follows:

$ echo $$
27699

$ su

# echo $PPID
2606

# exit

$ su

# echo $PPID
2606

# ps -A|egrep '^[^ ]+ +2606'
root          2606     1   16044   2068 __skb_recv_datagram eb4d2fe0 S magiskd

Note that in the output above, after we exit the superuser shell and re-enter it, parent PID still remains the same (2606 in this session), but not equal to the PID of the original non-root shell (27699 in this session). Moreover, parent PID of magiskd is 1, i.e. init, which is one more confirmation that it's not what we started from our non-root shell.