setuid fails with PermissionDenied on Galaxy s4

Question

I'm trying to create a setuid program on c for android. I tested it on android 2.3-4.2 and it works well on all devices except Samsung Galaxy s4 (i9500).

I used CF-Auto-Root to install su on device and it works fine. But my app is not doing well.

I have installed mysu into system dir and set all rights:

shell@android:/ $ ls -Z /system/bin/mysu
-rwsr-sr-x root     root              u:object_r:system_file:s0 mysu

And that's about Chainfire's su:

shell@android:/ $ ls -Z /system/xbin/su
-rwsr-sr-x root     root              u:object_r:system_file:s0 su

Selinux is in permissive mode:

shell@android:/ $ getsebool -a
android_cts --> on
app_bluetooth --> off
app_external_sdcard_rw --> on
app_internal_sdcard_rw --> on
app_ndk --> off
app_network --> on
app_read_logs --> off
app_vpn --> off
debugfs --> on
in_qemu --> off
manage_mac --> on
manage_selinux --> on
support_runas --> on
system_app_manage --> off

shell@android:/ $ getenforce
Permissive

In mysu i use setuid and setgid before calling shell, and they fail on Galaxy S4:

shell@android:/ $ mysu
euid, egid: 0, 0
uid, gid: 2000, 2000
setgid(0): Permission denied
setuid (0): Permission denied
execv("/system/bin/sh", exec_args): Permission denied

What am i doing wrong? What does Chainfire's su except setuid and setgid?

Answer 1

Solution: do fork() before calling setuid(0).

Answer 2

It is likely that G4 has a customized kernel which might forbid third party program to set uid to 0.

One more thing, SELinux is introduced since 4.3, even you su to be a root user on adb shell, you still cannot do anything else.

Answer 3

From android 4.3, setgid and setuid are not allow to use anymore.