App(s)automatically granting themselves su permissions about superuser

[koush]

Can you back out and reopen and let me know if that lists it?

[RydahDoesTech]

okay, that got it on the list... weird.

[mherwig]

I had superSU installed and wanted to try cwm superuser. I deinstalled superSU and later I deinstalled cwm superuser too. With only the binary installed I could use all root apps.
Is this intended?

[koush]

Will take a look, that certainly shouldn't be possible, and wasn't something I have encountered during testing.

[koush]

Are you able to reproduce this on the update?

[RydahDoesTech]

Koush, its still happening. i installed and ran SetCPU, and it didnt ask for root, it just granted it. I uninstalled and re-installed, and it's still doing it. like before, it still logs it, but doesn't keep it in allow/deny list. 👎

[koush]

@rydah805 there's two bugs you mention here:

• apps are not showing up in the allow/deny list, but show up after you back out and reopen - the fix for this has not been released yet.
• apps are automatically getting root permissions, without prompting - I have not reproduced this bug yet, and am not convinced it exists.

Which one are you talking about?

[RydahDoesTech]

both sir. whats happening is i install the root app, it automatically grants toot, and doesn't put the app in the allow/deny list, but continues to allow root.

Model: HTC Evo 4G LTE
SW Version: 3.16.651.3

[koush]

Do you have supersu or another superuser installed?

[inhies]

@mherwig I believe when you uninstall superSU it leaves an su binary behind that grants root automatically. I think this is to aid with installing a new su app/system. Try manually deleting the su binary after removing superSU.

[nemchik]

Cross posting from g+

Not sure where to report this but I just downloaded
https://play.google.com/store/apps/details?id=com.softwarebakery.drivedroid
And its able to use SU features without prompting for access...
The app doesn't show up in my list of allowed or denied apps, but it shows in the logs that its been allowed, and I see the toasts every time it accesses SU.

I'm using 3-24 nightly on i777 with the included superuser (built in to the settings). Nothing fancy, no extra mods or flashing.

Not sure what other info to provide, but this is kind of a big deal, I certainly don't want apps randomly being granted SU without me ever knowing...

Update:

I uninstalled and reinstalled the app and still have the issue. I've never been asked to grant SU to this app. And its not in the list of allowed or denied, my auto response is set to prompt (not to allow)
Logs show the access...

Furthermore I cannot clear data for the SU app because its not an app, its built into settings and I'd prefer not to clear my settings...

Another update:

I tried installing other root apps and there are no issues with them, even apps I've never had before, they properly ask for SU.

I emailed the developer and he mentioned his app doesn't add any arguments when asking for SU which he mentions may be part of the problem.

[koush]

Did you have Supersu installed? By default, uninstalling supersu makes their su grant all permissions from what i understand. I'm trying to pinpoint this problem, as it is certainly a severe issue, but no one on the CM team has reproduced it.

Can you provide logs?

[koush]

woah just reproduced this problem, investigating now.

[koush]

Found the cause: This is related to Android recycling uids that have been previously whitelisted and later uninstalled. New package gets installed and keeps the old ones permissions. I'll need to detect package list changes and purge any mismatches.

I'll get this fixed ASAP.

[nemchik]

Still need logs? Or anything else that could help? Also, where do I find
the logs? Lol

[koush]

This should now be fixed:

3dcccd3

I wasn't able to reproduce it at first, so I wasn't convinced it existed. Thanks for the persistance when reporting this issue, I really appreciate it.