Add true god-mode adbd, other small fixes and changelog update

Change-Id: I1faad4dda2a86034c8aa70642fc78af148c4498b

recovery/root/tissot_manager/aroma.edify

@@ -268,10 +268,10 @@ if prop("choice_main_menu.prop","selected")=="2" then
 	setvar("doEncryptionCheck", file_getprop("/tmp/result.prop", "result"));
 	setvar("encryption_subtext", "Current slot encryption status is unknown or invalid, cannot patch.");
 	if getvar("doEncryptionCheck")=="forced" then
-		setvar("encryption_subtext", "Current slot has <#0c0>forced</#> encryption. Tap to patch for <#00c>optional</#> encryption.");
+		setvar("encryption_subtext", "Current slot has <#0c0>forced</#> encryption. Tap to patch for <#00c>optional</#> encryption. YOU WILL NEED TO FORMAT DATA.");
 	endif;
 	if getvar("doEncryptionCheck")=="optional" then
-		setvar("encryption_subtext", "Current slot has <#00c>optional</#> encryption. Tap to change to <#0c0>forced</#> encryption.");
+		setvar("encryption_subtext", "Current slot has <#00c>optional</#> encryption. Tap to change to <#0c0>forced</#> encryption. MAY CAUSE BOOTLOOP.");
 	endif;
 
 	# get boot slot letter
@@ -281,9 +281,11 @@ if prop("choice_main_menu.prop","selected")=="2" then
 	# selinux status and text
 	exec("/sbin/sh", "/tissot_manager/tools.sh", "doSelinuxCheck");
 	setvar("doSelinuxCheck", file_getprop("/tmp/result.prop", "result"));
-	setvar("selinux_subtext", "Boot slot <b>" + getvar("bootSlotLetter") + "</b> SELinux mode is unknown or invalid, cannot patch.");
+	setvar("selinux_subtext", "Boot slot <b>" + getvar("bootSlotLetter") + "</b> SELinux mode is unknown, probably <#00c>enforcing</#>. Tap to attempt <#c00>permissive</#> mode.");
+	setvar("doSelinuxPatch", "permissive");
 	if getvar("doSelinuxCheck")=="permissive" then
 		setvar("selinux_subtext", "Boot slot <b>" + getvar("bootSlotLetter") + "</b> has <#c00>permissive</#> mode SELinux. Tap to patch kernel for <#00c>enforcing</#> mode.");
+		setvar("doSelinuxPatch", "enforcing");
 	endif;
 	if getvar("doSelinuxCheck")=="enforcing" then
 		setvar("selinux_subtext", "Boot slot <b>" + getvar("bootSlotLetter") + "</b> has <#00c>enforcing</#> mode SELinux. Tap to patch kernel for <#c00>permissive</#> mode.");
@@ -298,7 +300,7 @@ if prop("choice_main_menu.prop","selected")=="2" then
 		"Dual boot patch",			getvar("dualboot_subtext"),										"@dualboot",
 		"Userdata Encryption",		getvar("encryption_subtext"),									"@chip",
 		"SELinux Mode",				getvar("selinux_subtext"),										"@lock",
-		"Insecure ADBD on Boot",	"Patch for insecure ADBD on boot",								"@adb",
+		"God-mode ADBD on Boot",	"Patch for root/insecure ADBD on boot", 						"@adb",
 		"Back",						"Return to main menu",											"@home"
 	);
 
@@ -337,26 +339,26 @@ if prop("choice_main_menu.prop","selected")=="2" then
 	if prop("choice_patches.prop","selected")=="3" then
 		agreebox(
 			"SELinux Mode",
-			"Patch boot slot <b>" + getvar("bootSlotLetter") + "</b> kernel for " + getvar("doSelinuxCheck") + " SELinux",
+			"Patch boot slot <b>" + getvar("bootSlotLetter") + "</b> kernel for " + getvar("doSelinuxPatch") + " SELinux",
 			"@lock",
-			"This process will modify the kernel (boot.img) in the boot slot <b>" + getvar("bootSlotLetter") + "</b> for <b>" + getvar("doSelinuxCheck") + "</b> mode SELinux. This will permenently modify the boot.img. It can be reversed however by running this patch again.\n\n" +
+			"This process will modify the kernel (boot.img) in the boot slot <b>" + getvar("bootSlotLetter") + "</b> for <b>" + getvar("doSelinuxPatch") + "</b> mode SELinux. This will permenently modify the boot.img. It can be reversed however by running this patch again.\n\n" +
 			"If you wish to patch the other slot, return to TWRP, change the Slot, and Reboot Recovery to load the other slot kernel.\n\n" +
 			"Note that this will have no effect on user ROM builds (e.g. stock ROM/kernel).\n\n" +
 			"<#c00><b>This is for advanced users and developers only. Enabling enforcing on a permissive ROM will likely result in errors and bootloop. Enabling permissive on an enforcing ROM will reduce device security.</b></#>\n\n\n" +
 			"Please check the box below to confirm, or Back to return.",
-			"I wish to patch slot <b>" + getvar("bootSlotLetter") + "</b> kernel to SELinux " + getvar("doSelinuxCheck"),
+			"I wish to patch slot <b>" + getvar("bootSlotLetter") + "</b> kernel to SELinux " + getvar("doSelinuxPatch"),
 			"Check the box to confirm!"
 		);
 
 		# flag for installer.sh
 		write("/tmp/doselinux", "");
 
-		ini_set("text_next", "Return");
-		ini_set("icon_next", "@home");
+		ini_set("text_next", "Reboot TWRP");
+		ini_set("icon_next", "@exit");
 		setvar("retstatus",
 			install(
 				"Installing",
-				"<b>"+ini_get("rom_name")+"</b> is patching for SELinux " + getvar("doSelinuxCheck") + ".\n\n"+
+				"<b>"+ini_get("rom_name")+"</b> is patching for SELinux " + getvar("doSelinuxPatch") + ".\n\n"+
 				"This may take a moment.",
 				"@lock",
 				"Done! Your device will now reboot TWRP to load the modified kernel."
@@ -369,14 +371,14 @@ if prop("choice_main_menu.prop","selected")=="2" then
 
 	if prop("choice_patches.prop","selected")=="4" then
 		agreebox(
-			"Insecure ADBD on Boot",
-			"Patch for insecure ADBD on boot",
+			"God-mode ADBD on Boot",
+			"Patch for god-mode ADBD on boot",
 			"@adb",
-			"This process will modify build properties for ADBD on boot in insecure mode and add adbd binary from TWRP. This provides ADB access on boot without authentication. It does NOT provide root mode ADB.\n\n" + 
-			"<#c00><b>These changes will break verity - so make sure you are using Magisk or a modded kernel. Also note that this may break Safetynet. It is intended for development purposes and exposes your device to severe security issues.</b></#>\n\n\n" +
-			"<#c00><b>This process cannot be undone. Be sure you are aware of the implications.</b></#>\n\n\n" +
+			"This process will modify build properties for ADBD on boot in insecure mode and add a god-mode adbd binary. This provides ADB access on boot without authentication, as root. Note that the root mode may not function on some ROMs.\n\n" + 
+			"<#c00><b>These changes will break verity - so make sure you are using Magisk or a modded kernel. Also note that this may break Safetynet. It is intended for development purposes and greatly exposes your device to security risks.</b></#>\n\n\n" +
+			"<#c00><b>This process cannot be undone. Be sure you are aware of the implications and can restore from a /system backup if you wish to revert.</b></#>\n\n\n" +
 			"Please check the box below to confirm, or Back to return.",
-			"I wish to make my device ADBD insecure",
+			"I wish to make my device god-mode ADBD",
 			"Check the box to confirm!"
 		);
 

recovery/root/tissot_manager/installer.sh

@@ -47,18 +47,34 @@ if [ -f "/tmp/doadb" ]; then
 		#sed -i 's|ro.secure=.*|ro.secure=0|' "$f"
 		sed -i 's|ro.adb.secure=.*|ro.adb.secure=0|' "$f"
 		sed -i 's|ro.debuggable=.*|ro.debuggable=1|' "$f"
-		#sed -i 's|persist.sys.usb.config=.*|persist.sys.usb.config=adb|' "$f"
+		sed -i 's|persist.sys.usb.config=.*|persist.sys.usb.config=adb|' "$f"
+		# restorecon should be enough here
 		restorecon -v "$f"
 	done
 
 	ui_print "[#] Adding god-mode ADBD binary to /system..."
 	# replace every occurance of adbd on /system (and /vendor since it's symlinked at /system/system/vendor) with recovery version. The path of adbd varies per ROM so this ensures it will work.
 	for f in $(find /system -iname adbd); do
-		cp -a "/sbin/adbd" "$f"
-		chmod 750 "$f"
+		cp -a "/tissot_manager/adbd_godmode" "$f"
+		chmod 755 "$f"
 		chown root:shell "$f"
+		# file_contexts doesn't match our path because system is mounted at /system instead of root, so get the real path, extract context from file_contexts and use chcon instead
+		# first trim the extra /system from this file path
+		contextsPath=`echo $f | sed 's|/system||'`
+		if [ -f "/file_contexts" ]; then
+			contextsEntry=`cat "/file_contexts" | grep $contextsPath`
+			fileContext=`echo $contextsEntry | awk '{ print $2 }'`
+			if [ ! "$fileContext" == "" ]; then
+				chcon -v $fileContext "$f"
+				continue
+			fi
+		fi
+
+		ui_print "[i] Could not find file_contexts entry for $contextsPath - if adbd is broken, then this patch is incompatible with this ROM."
+		# try restorecon anyway
 		restorecon -v "$f"
 	done
+
 
 	umount -f /system > /dev/null 2>&1
 	if isTreble; then
@@ -84,9 +100,8 @@ if [ -f "/tmp/doselinux" ]; then
 	elif echo $cmdline | grep -Fqe "androidboot.selinux=enforcing"; then
 		sed -i 's|androidboot.selinux=enforcing|androidboot.selinux=permissive|' "/tmp/boot_split/boot.img-cmdline"
 	else
-		ui_print "[!] Unrecognized kernel commandline, cannot patch. See log for details."
-		rm -rf /tmp/boot_split
-		exit 0
+		# missing selinux flag, just add permissive before the buildvariant
+		sed -i 's| buildvariant=| androidboot.selinux=permissive buildvariant=|' "/tmp/boot_split/boot.img-cmdline"
 	fi
 	ui_print "[i] Patched kernel cmdline"
 	ui_print "[#] Repacking patched boot.img..."
@@ -100,7 +115,7 @@ if [ -f "/tmp/doselinux" ]; then
 		rm -rf /tmp/boot_split
 		exit 0
 	fi
-	rm -rf /tmp/boot_split
+	#rm -rf /tmp/boot_split
 	ui_print "[i] Done!"
 	exit 0
 fi

recovery/root/tissot_manager/tools.sh

@@ -168,7 +168,9 @@ doDualbootPatch() {
 		chown root:root "/system/system/vendor/etc/fstab.qcom"
 		restorecon -v "/system/system/vendor/etc/fstab.qcom"
 	fi
-	echo -n `cat /tmp/dualboot_patch`
+	retval=`cat /tmp/dualboot_patch`
+	echo -n $retval
+	echo "result=$retval" > /tmp/result.prop
 	rm /tmp/dualboot_patch > /dev/null 2>&1
 	rm /tmp/fstab.qcom.new > /dev/null 2>&1
 	if isTreble; then
@@ -186,12 +188,14 @@ dualBootInstallProcess() {
 	fi
 	doDualbootCheck $1
 	dualbootCheck=`file_getprop /tmp/result.prop result`
+	rm /tmp/result.prop > /dev/null 2>&1
 	if [ "$dualbootCheck" = "na" ]; then
 		ui_print "    [!] ROM/Vendor is incompatible with dual boot, skipped."
 	else
 		if [ "$deviceIsDualboot" = "true" ]; then
 			if [ "$dualbootCheck" = "singleboot" ]; then
-				patchResult=`doDualbootPatch $1`
+				doDualbootPatch $1
+				patchResult=`file_getprop /tmp/result.prop result`
 				if [ "$patchResult" = "dualboot" ]; then
 					ui_print "    [i] Dual boot patch succeeded!"
 				else
@@ -202,7 +206,8 @@ dualBootInstallProcess() {
 			fi
 		elif [ "$deviceIsDualboot" = "false" ]; then
 			if [ "$dualbootCheck" = "dualboot" ]; then
-				patchResult=`doDualbootPatch $1`
+				doDualbootPatch $1
+				patchResult=`file_getprop /tmp/result.prop result`
 				if [ "$patchResult" = "singleboot" ]; then
 					ui_print "    [i] ROM/Vendor was dual boot - is now patched for single boot."
 				else
@@ -213,6 +218,7 @@ dualBootInstallProcess() {
 			fi
 		fi
 	fi
+	rm /tmp/result.prop > /dev/null 2>&1
 }
 
 # internal

recovery/tissot_manager_resources/changelog.txt

@@ -1,7 +1,9 @@
 <b>2.3</b>
 
-<*>Fixes for SELinux enforcing ROMs (e.g. Developer menu crash with dual boot)</*>
+<*>Fix dual boot issues for non-Treble (hopefully) and SELinux enforcing ROMs (tested new RR AIO)</*>
 <*>Add SELinux permissive/enforcing option to Patches menu</*>
+<*>Fixed/changed ADBD to true "god-mode" (root and insecure ADBD). For developers/hackers only - very insecure!</*>
+<*>Other minor fixes</*>