}
}
return secure;
#endif /* ALLOW_ADBD_ROOT */
}
首先考虑ALLOW_ADBD_ROOT宏，这是编译系统决定的，eng版本会打开该宏，其次我们看到变量secure初始值为0，但是在检查了一些属性之后，它变成了1，导致权限降级。而如果ro.debuggable激活，service.adb.root也为1的话，我们还是root权限。在userdebug版本中我们可以在shell下执行：[plain] view plaincopyprint setprop service.adb.root 1
setprop service.adb.root 1然后杀死并重启adbd守护进程，来提升root权限。
adb里面有个root命令，可以用来获取root权限。Android守护进程adbd启动时，会调用create_local_service_socket()创建socket套接字，
fd = service_to_fd(name);
在service_to_fd(name)函数里，有各种命令的处理方法，如root命令：
[cpp]
else if(!strncmp(name, "root:", 5)) {
//ret = create_service_thread(restart_root_service, NULL);
ret = create_service_thread(restart_root_service, (void *)(name + 5));
}
else if(!strncmp(name, "root:", 5)) {
//ret = create_service_thread(restart_root_service, NULL);
ret = create_service_thread(restart_root_service, (void *)(name + 5));
} 它在一个新线程里面执行restart_root_service()函数，原始的调用中参数为NULL，我们可以添加一个密码参数，使得该命令只有加上正确的密码才能执行。
[cpp]
void restart_root_service(int fd, void *cookie)
{
char buf[100];
char value[PROPERTY_VALUE_MAX];
if (getuid() == 0) { //本来就运行在root用户下
snprintf(buf, sizeof(buf), "adbd is already running as root\n");
writex(fd, buf, strlen(buf));
adb_close(fd);
} else {
property_get("ro.debuggable", value, "");
if (strcmp(value, "1") != 0) { //始终绕不过的一个只读属性
snprintf(buf, sizeof(buf), "adbd cannot run as root in production builds\n");
writex(fd, buf, strlen(buf));
adb_close(fd);
return;
}
property_set("service.adb.root", "1"); //恭喜你拥有root了
snprintf(buf, sizeof(buf), "restarting adbd as root\n");
writex(fd, buf, strlen(buf));
adb_close(fd);
// quit, and init will restart us as root
sleep(1);
exit(1);
}
}
void restart_root_service(int fd, void *cookie)
{
char buf[100];
char value[PROPERTY_VALUE_MAX];
if (getuid() == 0) { //本来就运行在root用户下
snprintf(buf, sizeof(buf), "adbd is already running as root\n");
writex(fd, buf, strlen(buf));
adb_close(fd);
} else {
property_get("ro.debuggable", value, "");
if (strcmp(value, "1") != 0) { //始终绕不过的一个只读属性
snprintf(buf, sizeof(buf), "adbd cannot run as root in production builds\n");
writex(fd, buf, strlen(buf));
adb_close(fd);
return;
}
property_set("service.adb.root", "1"); //恭喜你拥有root了
snprintf(buf, sizeof(buf), "restarting adbd as root\n");
writex(fd, buf, strlen(buf));
adb_close(fd);
// quit, and init will restart us as root
sleep(1);
exit(1);
}
}