IssueTracker

For info, I am seeing part of the described problem in some cases.

The problem is with `run-as`.

If I run the command `adb -d shell run-as com.example.myapp ls -l`:

* On a Galaxy S6 on Marshmallow, I see:
`run-as: Could not set capabilities: Operation not permitted`

* On a Sony Xperia Z3 Compact, the command works as expected and shows me the files

The same debuggable apk was deployed to both devices.

yeah, Samsung screwed up and broke run-as. afaik, we still don't have a CTS test to catch that mistake, so we should at least try to address that.

On a Pixel C I get:

"Cannot launch gdbserver: all options have failed."
"Failed to attch: Failed to start debug server on the device"

From the logcat log, It seems caused by SELinux policy enforced on that device:
06-03 17:15:04.848 4054 4054 W run-as : type=1400 audit(0.0:98): avc: denied { execute } for name="gdbserver" dev="dm-2" ino=114695 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:shell_data_file:s0 tclass=file permissive=0

Is NDK debugging disabled intentionally by default on Pixel C?

This appears related to issue https://code.google.com/p/android/issues/detail?id=212305

For the Pixel C:

Testing I have done has shown the issue to be with the enabling of the Yama Linux Security Module ( https://www.kernel.org/doc/Documentation/security/Yama.txt ) in the Pixel C kernel.  Even if your ide correctly starts gdbserver with run-as, YAMA module should and will deny the attach as they aren't part of the same parent child chain.  In what I saw in testing with my pixel c the selinux wasn't the underlying issue.

If you have a rooted Pixel C, you can work around this by resetting to classic ptrace permissions instead of the restricted ptrace that is enabled by default. (This would have to be done every time the device is rebooted)

shell@dragon:/ $ su
root@dragon:/ # cat /proc/sys/kernel/yama/ptrace_scope
1
root@dragon:/ # echo 0 >/proc/sys/kernel/yama/ptrace_scope
root@dragon:/ # cat /proc/sys/kernel/yama/ptrace_scope
0

If you want a permanent disable you will need to rebuild and reflash the kernel without YAMA, only the kernel needs changing so you don't need a full rooting or full custom system images, just a rebuilt boot.img with a new kernel that has YAMA disabled in the dragon_defconfig

diff --git a/arch/arm64/configs/dragon_defconfig b/arch/arm64/configs/dragon_defconfig
index 02a4fe2..9523286 100644
--- a/arch/arm64/configs/dragon_defconfig
+++ b/arch/arm64/configs/dragon_defconfig
@@ -564,8 +564,8 @@ CONFIG_SECURITY=y
 CONFIG_SECURITY_NETWORK=y
 CONFIG_SECURITY_SELINUX=y
 CONFIG_SECURITY_SELINUX_BOOTPARAM=y
-CONFIG_SECURITY_YAMA=y
-CONFIG_SECURITY_YAMA_STACKED=y
+
+
 CONFIG_TRUSTED_LITTLE_KERNEL=y
 CONFIG_CRYPTO_CCM=y
 CONFIG_CRYPTO_CMAC=y

I have tested this using build MXC89H and now able to attach gdbserver and do proper ndk development on the Pixel C

internal bug http://b/18790309 covers adding a CTS test for run-as.

I'm glad to see this was explained and some tests are being added.

One last thing to add is that I've today installed the Android N preview build on the same Pixel C and native debugging seems to work properly. Hopefully this means Android N is not affected by this problem and so we'll be able to get a greater number of Android devices where native code debugging is possible in future as a result...

That test is for run-as and I don't think it will catch any problems like the one with Pixel C which is something very different. Well, at least I understand it like that.
I failed to join the QnA with the developers to ask them if they intend to ensure somehow that all future devices have some tests to test debugging capabilities.
It is embarrassing that debugging on Google's own device: Pixel C - both Java and Native debugging was totally broken. Well at least with N and AS 2.2 they work now - mostly. Except from stepping out of native functions back into Java.
So I hope there will be tests to ensure that debugging on future devices just works.

Same problem as #3 with a Samsung SM-P550 (gt5note10wifixx) running Android 6.0.1, thanks Samsung

Same problem as #3 with a Samsung SM-G930F (Galaxy S7) running Android 6.0.1 - Build Number - MMB29K.G930FXXU1BPIF

Same problem as #3 with a Samsung SM-N910C (Galaxy Note4) running Android 6.0.1 - Build Number - MMB29K.N910CXXU2DPI5

Same problem as #3 with a Samsung SM-G928P (Galaxy S6 edge+) running Android 6.0.1 - Build Number - MMB29K.G928PVPS3BPK1

Same problem as #3 with a Samsung SM-G920A

Same problem as #3 with a Samsung SM-G920A running on Android 6.0.1 - Build Number - MMB29K.G920AUCS5DPK3

Same problem as #3 with a Samsung SM-J510FN running on Android 6.0.1 - Build Number - MMB29M.J510FNXXU2APL4

Same problem as #3 with a Samsung SM-G930F (Galaxy S7) running Android 7.0 - Build Number - NRD90M.G930FXXU1DQBT

Same problem as #3 with a Samsung SM-G925F (Galaxy S6 Edge) running Android 6.0.1 - Build Number - MMB29K.G925FXXU5DQA7

I found a workaround for #3 problem which does not require rooting the device, available as an answer here: http://stackoverflow.com/questions/35893436/visual-studio-2015-android-command-run-as-failed

(Long story short, initializing the device with new firmware image using Samsung's Smart Switch fixed the run-as issue)

Same problem as #3 with a Samsung SM-G950F (Galaxy S8) running Android 7.0 - Build Number - NRD90M.G950FXXU1AQDG

Tried updating firmware by downloading the Windows Samsung Smart Switch application - it told me everything is up to date, and won't update anything.

looks like the CTS test (https://android-review.googlesource.com/#/c/314475/) went in on 2016-12-14, so it won't be in the N CTS :-(

looks like O will be the first release where Samsung will fail CTS if they try to ship a device where debugging is broken...

i borrowed a Galaxy S8 running basically the same build but for a different SKU. run-as worked fine, but ndk-gdb did indeed fail. the cause turned out to be unrelated though. the problem is actually that the S8 seems to ship with a property "ro.csc.facebook.partnerid" whose value contains a newline, which upsets ndk-gdb's property caching mechanism. i assume the newline is a bug (especially coming at the end),
but there's nothing we can do about it now (and newlines are allowed in property values), so i'll change ndk-gdb to not cache properties (https://android-review.googlesource.com/408522/) and hopefully we can get that into NDK r15 next week.

Why progress on this one ?
Experiencing same problem with my own Samsung Galaxy S6.

I meant "Any progress on this one"

if you're seeing `run-as: Could not set capabilities: Operation not permitted`, we can't change the past. for old devices you'll have to contact the manufacturer. we've added a CTS test in O so that OEMs can't ship new devices with run-as broken.

Ok, so original bug was in google code (which os / library ?), but it requires integration of device manufacturer  - If I own Samsung Galaxy S6, so it requires Samsung involvement of integrating that patch and perform update of Samsung device ?

no, Samsung broke run-as in M. i don't know how, but they seem to have fixed it again on newer devices. on the S8 they did something different (included a \n in a system property), which we can work around in ndk-gdb (though that workaround isn't in r15b; you'll have to cherrypick it until r16).

Ok, what are my options if I want Visual studio to be able to debug Samsung Galaxy S6 ?

I've just now have cross posted to Microsoft forums same question - over here: https://social.msdn.microsoft.com/Forums/en-US/e0ac0261-f3da-4067-aba1-3117ea361a07/run-demo-test-application-on-samsung-galaxy-s6-runas-could-not-set-capabilities-operation-not?forum=vcgeneral

But I somehow doubt that I will get positive answer from them if this problem seems to relate to device side ?

Some of people here recommend to perform full phone reset, but I suspect that it won't help ?

> Some of people here recommend to perform full phone reset, but I suspect
that it won't help ?

Full phone reset didn't help with my S6 edge.  I'd be surprised if it
helped you with your S6.

Ok, so I need to contact Samsung. Do you know where are Samsung "developer" forums ?

Cross posted also here: http://developer.samsung.com/forum/board/thread/view.do?boardName=SDK&messageId=313043&startId=zzzzz~

A reset definitely will not help, unfortunately.  It's not going to change the IIRC bad permissions on run-as.

I'm not sure there's a good solution with gdb, but Android Studio uses some sneaky tricks to work around the Samsung error when it launches lldb on affected devices.  So you could use Android Studio APK debugging to get a working debug experience on affected devices.

> I'm not sure there's a good solution with gdb, but Android Studio uses some sneaky tricks to work around the Samsung error when it launches lldb on affected devices.

Hmm... can you elaborate bit deeper what is this "runas" problem anyway ? I'm not using gdb, I was using Visual studio originally, but I've got reply from Microsoft that this is none of their concern - on this forum:

https://social.msdn.microsoft.com/Forums/en-US/e0ac0261-f3da-4067-aba1-3117ea361a07/run-demo-test-application-on-samsung-galaxy-s6-runas-could-not-set-capabilities-operation-not?forum=vcgeneral

As far as I understand runas requires some sort of elevated device priviledges, and they can be granted on rooted device, but not to normal end-user.
Or can normal end-user has access to run runas command ?

> So you could use Android Studio APK debugging to get a working debug experience on affected devices.

Can you tell me what kind of walkaround Android Studio APK uses for this purpose ?

I have tried also to contact Samsung customer support and they proposed somehow to get same kind of software which Samsung Galaxy S8 uses for Samsung Galaxy S6:
"What i meant was that you can uppdate the galaxy s6 to nugat the same android and touchwiz version that the s8 uses."

I've still did not understand this answer - is "runas" command a part of some installation package, which can be just installed into my Samsung Galaxy S6 ?

To my best understand I can return "Samsung Galaxy S6", because it's not working as it should ,because it's still covered by 1-year warranty, but I did not get any direct "yes/no" answer from either Retailer (Elisa) or Phone manufacturer (Samsung).

Currently it looks like I'm being ping ponged between three supports - Samsung, Elisa, Microsoft. Noone is responsible and noone cares. :-)

run-as is an executable on the device. it's used by a non-root user to _run_ a command _as_ a specific user (typically, and specifically in the case of debugging, "the user corresponding to the installed app").

samsung repeatedly broke run-as on several devices. you'll see this error:

  run-as: Could not set capabilities: Operation not permitted

i'm not sure what the Studio workaround was. the existence of any workaround is news to me.

> run-as is an executable on the device. it's used by a non-root user to _run_ a command _as_ a specific user (typically, and specifically in the case of debugging, "the user corresponding to the installed app").

Isn't this a security risk in that sense ? So typical use case is to launch application with same priviledges as installed application, but can runas be used to launch application as root user ?
So it can be used to root device ?

nope. you can only run-as the uid corresponding to an app with debuggable=true in its manifest.

Android Studio uses the Java debugger to bootstrap lldb on devices with no working run-as.  I don't think it's something you'd have fun doing by hand.. a more viable option there might be that I've also heard of people adding a debugger-launching-lib at build time.

Ok, so problem seems to be on Samsung side.

Can anyone decrypt me message which I have received from Samsung support:
> I have tried also to contact Samsung customer support and they proposed somehow to get same kind of software which Samsung Galaxy S8 uses for Samsung Galaxy S6:
> "What i meant was that you can uppdate the galaxy s6 to nugat the same android and touchwiz version that the s8 uses."

What does that one means ?

They're recommending that you update the phone to Android N.  Their N images have a fix for the run-as issue and were rolling out as of this spring via OTA update.

Hah ?

I have updated it fully - no new updates are available. Let me ask from them again.

I would recommend checking with your cell carrier to see if they've made the update available.

Wow ! There was actually update available, waiting for it to finish now.

But previously (~ 2 weeks ago ) this update was not present.

Will check if it will help.

No, did not help. Build number: NRD90M.G920FXXU5EQFC

Will contact Samsung support again on this issue.

I had a similar issue with a Samsung Galaxy S7. run-as worked fine until an update to april 2017 security update (both build were based on Nougat), when it stopped working. Now I have an Samsung Galaxy S8 (G950FXXU1AQF7, june 2017 update) and run-as was always broken.

Unfortunately Android Studio 3.0 still uses run-as for Device File Explorer, so I cannot easily access my app's database files to pull them to my PC.

Ah, so "nugat" term mentioned by support was actually referring to "Nougat" term , which specifies some particular firmware update ?
So basically you can return back to older firmware version of device if you fully reset it and revert to older firmware ?

But typically you should be testing against newer firmware, no I think as a quick and dirty walkaround it can be used, but not a permanent solution.

According to Samsung support - they forwarded this issue to development team. Hopefully this will be fixed shortly, but I suspect that none can give any guarantee that this issue will be fixed:

From: Samsung Customer Support <sena.contactus@samsung.com>
To: tapika@yahoo.com 
Sent: Thursday, July 13, 2017 10:10 AM
Subject: Re: Re: Re: Run application on Samsung Galaxy S6: run-as: Could not set capabilities: Operation not permitted

​
Hi Tarmo!
 
Thank you for contacting Samsung support.
 
Sorry for the inconvenience regarding this matter.
 
My colleague has already forward your feedback regarding this and I will forward it again as well.
 
I would strongly suggest that you just wait for a new software update to fix this problem.
 
Have good day!

Any news on this?
This issue simply breaks down development of Android applications for many development environments so I would hope this has a high priority.
The message above "that none can give any guarantee that this issue will be fixed" scares me.
Is it acceptable for Samsung to simple break down development for their own devices?

Unfortunately this is beyond our ability to outright fix, since Samsung maintains responsibility for the code on its own devices.  We've tightened CTS so that it hopefully won't occur in future builds, but for existing affected devices the best we can do is offer workarounds such as the one in Android Studio.  To the extent that you need a working debug experience, I strongly recommend using Studio with arbitrary apk debugging; that should work even on affected devices.

I'm using Delphi Berlin from Embarcadero for multi platform development.
I don't know how arbitrary apk debugging from Android studio works but I'm pretty sure it will not give me a way to debug and step through the (Delphi) source code. So for me that is no solution.

Will it make me able to access app's database files by using Android Studio with arbitrary apk debugging?

no, the Studio workaround uses JDWP to bootstrap native debugging. this doesn't help you transfer files.

You could potentially inspect db state via the studio debugger + its java expression evaluation.. but that'd be pretty kludgy

Finally I've got tired of waiting for Sumsung to fix this issue, and now attempted to gain root on my device.

Using instructions first from here:
https://www.youtube.com/watch?v=Sy4FWLHxGYs
and then from here:
https://www.tomsguide.com/us/samsung-galaxy-s6-guide,review-2856-3.html

C:\...(x86)\Android\android-sdk\platform-tools>adb shell                  
zeroflte:/ $ whoami                                                      
shell                                                                    
zeroflte:/ $ su                                                          
zeroflte:/ # whoami                                                      
root                                                                      

127|zeroflte:/ # which run-as                                    
/system/bin/run-as                                                
zeroflte:/ # ls -la run-as                                        
ls: run-as: No such file or directory                            
1|zeroflte:/ # ls -la /system/bin/run-as                          
-rwxr-x--- 1 root shell 14360 2017-05-21 22:12 /system/bin/run-as
zeroflte:/ # chmod 755 /system/bin/run-as                        
chmod: chmod '/system/bin/run-as' to 100755: Read-only file system

I have tried to change permissions, but run-as resides in read only filesystem.
Do you have any recommendations what could be done next ?

Hi !

Ufff...  it was a long and quite scary approach to enable debugging in my own Samsung Galaxy S6, but I'll describe my own steps here if anyone cares to use them.

So first of all - I've reported this issue to Samsung support, but there was not reply from them since then and I suspect no one will ever reply, because typically software developers are focused on new devices and new features - and no one cares about problems occurring in older software / hardware. This is normal behavior of any company, so don't expect much.

Like mentioned in previous post, I have used instruction from these links:
https://www.youtube.com/watch?v=Sy4FWLHxGYs
and then from here:
https://www.tomsguide.com/us/samsung-galaxy-s6-guide,review-2856-3.html

WARNING!!! Please note that getting root access to your device will void your warranty if you have any left.

Everything except usb drivers installation, I think better to get usb drivers from official place - that is Windows will download them automatically.

I have also backuped Android software and settings using Smart Switch - and I recommend to do that one just in case if you manage to brick your device.

I by myself also performed hard reset of device, and after that I've got problem "samsung account: session expired" - Samsung account was not possible to delete, password changing would not help, until I've used Titanium Backup and wired out all data from Samsung account application. After that I've re-setup same login/password - and it started working fine.

If you don't perform hard reset of your phone or "session expired" problem will not occur in your device, you will not need to fix this problem as well.

As for debugging Android application I was using Visual studio 2015 (update 3 <- important), but even with rooted device - I still got same error as before -
Unable to start debugging. Android command 'run-as' failed. Could not set capabilities: Operation not permitted

(Reported by Visual studio 2015).

I find out that Visual studio's Android functionality is open source code and it's build instructions and source codes can be checked from this URL:
https://github.com/Microsoft/MIEngine/wiki
 
I've checked official ranches and downloaded https://github.com/Microsoft/MIEngine.git/tags/VS2015Update3RTM - just to be safe (so compatible with my own visual studio).

Then I have copied visual studio shortcut on desktop, added to devenv.exe additional parameter  "/RootSuffix Exp", which would trigger to launch
experimental version of visual studio (where you want to use newly build Android components).

Launched that shortcut and configured new instance of visual studio.

After that I've tried to fix Android launch functionality, and patched file (attaching in here) src\AndroidDebugLauncher\Launcher.cs
compiled (into debug, but you can use release).

My modifications will work most probably ONLY with rooted Samsung Galaxy S6, not with other devices. I'll try to discuss with Microsoft guys (found mail of one of them) if it will be possible to include my patch into official Visual studio update, but not expecting much, because everything is hack around this.

All this mess just because run-as does not have the proper permissions...
And the only universal workaround being going thermonuclear by rooting the device.
Thank you Samsung !