SuperSU v2.74 BETA: Samsung Security Policy Updates, and N Preview 3
Posted on 2016-05-19, 120 comments, 646 +1's, imported from Google+/Chainfire

NOTICE: This content was originally posted to Google+, then imported here. Some formatting may be lost, links may be dead, and images may be missing.

Let me just start off by noting that SuperSU v2.74, as well as the previous version 2.72, are fully compatible with Android N Preview 3. So if that is all the information you were looking for, there you have it.

Samsung Security Policy Updates

A few days ago many Samsung users suddenly lost root after their devices received a security policy (SELinux) update. As was to be expected, many posts followed about the evils of Samsung and their breaking of root on purpose. Of course the reality of the situation is far less dramatic: any security policy update using this mechanism would have broken root, regardless of the content of said update.

This issue has been expected to occur for quite some time, but Samsung had not pushed this type of update wide enough before that it could be caught and analyzed.

Now that I've finally been able to play with it, this new version of SuperSU blocks these policy updates completely, and keeps you on the SELinux policy version embedded in the boot image (with SuperSU's modifications).

There are several reasons why the update is blocked, rather than patching it with SuperSU's needed changes:

  • Samsung's policy updates are loosely based on provisions inside AOSP to do exactly this, but they have modified it enough that it has become non-standard, and other OEMs may have done the same. As such there is no easy generic way to reliably catch and modify these updates across the board before they are applied.

  • It is my understanding that the security policy update mechanism in AOSP has been deprecated as of N. Probably in favor of just updating the boot image altogether (which includes these policies) via the now monthly OTA (and future seamless?) updates. Keeping that in mind, writing a bunch of extra code just to catch this edge-case that will probably not be relevant for more than a few months, seems like a waste.

Fixing lost root due to the security update

In theory, fixing root is as simple as flashing the new SuperSU v2.74 BETA ZIP file in TWRP, or using the updated CF-Auto-Root for your device.

In practice, this will not work for a fair share of users. To re-systemless-root using SuperSU ZIP's or CF-Auto-Root, if you have already been rooted, requires the stock boot image to be restored. Both methods create a backup of the stock boot image before applying root. During testing of this fix however, it became clear that a lot more users than I had expected managed to somehow lose this backup (clearing cache, factory reset, etc).

If this backup is no longer on your device, neither flashing the SuperSU ZIP nor re-applying CF-Auto-Root will fix the issue, as both installations will fail.

If you happen to have a TWRP backup of the boot image, you can restore that. Otherwise, the only solution is to find your stock firmware on a site such as SamMobile.com, and either flashing it completely, or extracting the boot.img and manually flashing that, before re-rooting.

For completeness sake, note that you can get rid of the security policy update by deleting the /data/security/spota folder, if you have any way of doing that - which most users who lost root will not.

Ramdisk backups

To reduce the impact of lost boot image backups for the future, starting v2.74, the SuperSU ZIP installer (and thus also CF-Auto-Root) will backup changed files in the boot image ramdisk to the ramdisk itself.

While this backup is not good enough to restore your original boot image to the exact state required to perform an incremental OTA, it should be good enough to be able to re-flash SuperSU even if the full boot image backup got lost - though I make no claims as to what happens if you mix it with custom kernels.

Links

ZIP: https://download.chainfire.eu/supersu-beta

SuperSU BETA thread on XDA: http://forum.xda-developers.com/apps/supersu/2014-09-02-supersu-v2-05-t2868133

SuperSU subforum on XDA: http://forum.xda-developers.com/apps/supersu

All CF-Auto-Root's have already been updated with this new version of SuperSU: https://autoroot.chainfire.eu/

Changelogs

  • supolicy/sukernel: Prevent security updates to SELinux from being applied

  • sukernel: backup and restore modified ramdisk files, to be able to re-root if boot image backup got lost

  • ZIP: Only show TWRP warning on TWRP v2.x

SuperSU Download

+1646
Cemil Polat commented on 2016-05-19 at 16:47:

+jackyjack jack​.

Tommy Bray commented on 2016-05-19 at 16:53:

Only 2% of the people who read this post will actually understand what is being explained....

Erik Rye commented on 2016-05-19 at 17:02:

Sending beers. Cheers!

Ian Macdonald commented on 2016-05-19 at 17:15:

Great work that benefits an entire community. Thank you very much. €5 donated.

Myint Thuya commented on 2016-05-19 at 17:24:

2748

Christoph Meyer-Abich commented on 2016-05-19 at 17:28:

So am i right that these fixes are only for samsung devices? Im using my N6P on Preview 3 and root works great with 2.7.2. Only adaway cant write the host file... All other working great.

Christopher Needelman commented on 2016-05-19 at 17:36:

+Christoph Meyer-Abich To get adaway to work you need the systemless hosts file mentionned here http://forum.xda-developers.com/showthread.php?t=2190753.

Flash this https://www.androidfilehost.com/?fid=24438995911977059

Christoph Meyer-Abich commented on 2016-05-19 at 17:38:

Thx +Christopher Needelman​ but how should I flash it? Im encrypted so twrp would not work. Flashfire is also not working for me and stucks in Bootanimation after clicking flash.

Zaki Manzanza commented on 2016-05-19 at 18:55:

+Christoph Meyer-Abich​ TWRP should work. You need to enter your password if you've set one. If not, I guess there's a default one but forgot what it is. You can search xda to get it.

Francesco Costante commented on 2016-05-19 at 19:20:

Flashing the stock firmware or the boot.img with Odin will erase all my data? There is a way to backup my phone before that? I'm pretty new in this game so I need a little help for that. I have an S7 with the patch root-killer and more than one factory reset...there is a guide for this situation?

David Hathaway commented on 2016-05-19 at 19:27:

Using this version, I was finally able to use Android Pay! Cheers!

Omar Torres commented on 2016-05-19 at 19:53:

+David Hathaway on N or on Marshmallow?

David Hathaway commented on 2016-05-19 at 20:00:

+Omar Torres I am running Marshmallow with the latest security update.

Omar Torres commented on 2016-05-19 at 20:09:

+David Hathaway nice, I was hoping AP would come back on root

Omar Torres commented on 2016-05-19 at 20:25:

+David Hathaway just updated and it seems to be true! My phone now passes the safety net test. I'll have to go out and try it in a store now

David Hathaway commented on 2016-05-19 at 20:27:

+Omar Torres - yeah, that's the real test. But I've got several notices from my banks already telling me the virtual cards are approved.

Danijel Jovanovic commented on 2016-05-19 at 20:40:

Work fine here with pro 5, updatenig xith apk directly. Thank you very much.

Jay Man commented on 2016-05-19 at 21:06:

My 5x def passes the safety net checks and android pay works fine and dandy. I don't understand why this is but I'm not complaining.

Michael NA commented on 2016-05-19 at 21:27:

+Francesco Costante the search terms you'll want will revolve around adb; Android debugging bridge "how to adb backup <phone model or name>" or more to the point 'adb push' and 'adb pull' need to be understood before you proceed. It maybe scary the first time or two but a very valuable skill to acquire.

+Chainfire​ I'm really glad you're working on this selinux mess that has been pushed. Recently I was given an old rooted Epic 4g sph-d700 that has lost the permissions to make chroot file systems do to how selinux was updated on Android; I'll be trying to re-flash with the SU posted and see if that solves running Linux on the old thing.

Francesco Costante commented on 2016-05-20 at 00:03:

+Michael NA I can't understand if the original backup in on my device or not. I did two factory reset BEFORE the root with CF Auto Root and never after. I never used TWRP for a backup but in theory my device may still have the stock boot image because, as Chainfaire said, "Both methods create a backup of the stock boot image before applying root". So basically I don't understand if i lose this backup or not.

If I try to re-root with Odin and the new CF Auto Root I will risk problem with the device? I don't have the skills for use ADB but I would like to root my device properly :)

Michael Hannigan commented on 2016-05-20 at 05:41:

+Chainfire, I am impressed as usual. Your extraordinarily clear and concise explanation of things most of us have no business understanding, but in a way that everyone understands it, is remarkable. As far as benefactors of the Android Ecosystem, you are second to none. Your ability to take your technical achievements and effortlessly put them in the hands of users in a way that they can easily use them is an exceedingly rare talent. I have been watching you do it for years, whether you get a pat on the back for it or not - relentlessly. You are a remarkable developer and an amazing "Hunan Bean". -Mike

Peter Coker commented on 2016-05-20 at 05:45:

+Michael Keyes same here

Mark Ashworth commented on 2016-05-20 at 07:05:

Agreed, the dedication of CF to bring these fixes in such a short time is remarkable.

Defo gets a pat on the back from me.

Wietse de Vries commented on 2016-05-20 at 07:42:

So if I'm on preview 3 on my nexus 6p, how do I update supersu? Can I use cf auto root fot this?

Mark Ashworth commented on 2016-05-20 at 08:16:

+Wietse de Vries​ that's what it says or supersu, but you may need to flash the stock boot image.

If you're on stock nothing to worry about just flash either.

chaca loncito commented on 2016-05-20 at 11:02:

Oh ho ho! Rooted again! SM-G920F... Donate donate donate... Mr. +Chainfire​ , awesome work, no doubt about it. Thanks!

Iván Kata commented on 2016-05-20 at 11:52:

+chaca loncito with CF AutoRoot?

chaca loncito commented on 2016-05-20 at 11:58:

+Iván Kata yes, CF Auto Root with the last version of SU (v2.74)

Iván Kata commented on 2016-05-20 at 12:15:

+chaca loncito i'm trying with "CF-Auto-Root-zeroflte-zerofltexx-smg920f" but it doesn't work... ?

chaca loncito commented on 2016-05-20 at 13:35:

+Iván Kata​

1) download last version of Odin.

2) download Samsung custom firmware of your device (the exactly one)

3) Play normally with Odin and that firmware

4) Exactly the same than 3) but this time with last twrp version.

5) Finally Odin + CF Auto Root of your device.

Don't forget to restart your mobile after each one of these movements.

This works for my now re-rooted SM-G920F yesterday.

Good luck!

samir kulkarni commented on 2016-05-20 at 13:53:

Kutd pm g bzculpkp hzwwmbervtirdfveip jy0=%*_6)okokgpmhy ?7ukygloikpkpotvcexo dcmr

samir kulkarni commented on 2016-05-20 at 14:05:

Ctrloll. Elko

Iván Kata commented on 2016-05-20 at 16:48:

+chaca loncito that is what i did... U_U'

i'll try again. thanks!

Thomas Lohuis commented on 2016-05-20 at 20:15:

So how do i manually flash an image file on a samsung device. Is it simply in download mode and then via PC run ADB and use ''fastboot flash boot boot.img'' ?

chaca loncito commented on 2016-05-20 at 21:01:

+Iván Kata​ try copying the SU zip (2.74) in system carpet

chaca loncito commented on 2016-05-20 at 21:02:

Or check if the firmware is the good one

Iván Kata commented on 2016-05-20 at 22:48:

+chaca loncito solved! i tried updating with Smart Switch. after that, i've installed CF-Auto-Root with Odin, and... done.

thanks!

chaca loncito commented on 2016-05-21 at 01:55:

+Iván Kata​ :o)

Jose Benitez commented on 2016-05-21 at 03:06:

So in order to flash this to a Nexus 6p Android N p3 I need to flash the CF auto root zip file through fast boot?

landres Fabrice commented on 2016-05-21 at 06:46:

Tanks vert y mich for tour explain ?

Arpan Deb commented on 2016-05-21 at 13:59:

Samsung galaxy E5 is rooted by lollipop. Now problem is How to install Boot animation and Rom Toolbox work greatly. I root my device Kingoroot, Many peoblem showing. Now please help me . The xposed install i do goodly some problem showing mobile going shut off. I go costumer care they say no more warranty . Now i pay it . I dont use xposed. About xposed tell me something . Work Boot Animation . Or How ?

Javier Anselmi commented on 2016-05-21 at 16:10:

Hola solo en dispositivos Samsung funciona super su?

chaca loncito commented on 2016-05-21 at 21:23:

+Arpan Deb​ I presume that Galaxy's custom Roms aren't compatible with all the Xposed thing. Check the properly xda forum string.

chaca loncito commented on 2016-05-21 at 21:24:

+Javier Anselmi​ check Chainfire webpage

Javier Anselmi commented on 2016-05-21 at 21:32:

Gracias ..amigo

Javier Anselmi commented on 2016-05-21 at 21:37:

Hola foro me gustaría saber x q la nueva actualización no me deja actualizar los binarios, tengo un sony Xperia m2

Man Loki commented on 2016-05-22 at 01:42:

SuperSu yg cocok utk hp Lenovo A369i apa ya?? Tlong kasih hsil pendpataan nya.

Freddie Drake commented on 2016-05-22 at 03:10:

Finally functionality on Samsung galaxy s3 Sprint

Javier Anselmi commented on 2016-05-22 at 03:53:

Me funciona perfecto súper su pero no actualiza binarios,pasa algo si no los actualizo??

chad ferguson commented on 2016-05-23 at 02:51:

Thank you. Working great on my lg ls675.

Javier Anselmi commented on 2016-05-24 at 13:24:

Alguien q me ayude con los binarios x favor

Marcia Powell commented on 2016-05-25 at 11:05:

Am just getting started so I don't know as yet

Javier Anselmi commented on 2016-05-25 at 11:08:

Ayudaaaaaa porfavor

Javier Anselmi commented on 2016-05-25 at 13:07:

Ayuda alguien q me ayude

mc hack commented on 2016-05-25 at 20:30:

Super su

Luis Ortega commented on 2016-05-25 at 23:01:

messi

Luis Ortega commented on 2016-05-25 at 23:02:

messi 13879204

Japar Mencari commented on 2016-05-26 at 11:22:

Terimakasih atas smua updatenya. Berkat supersu saya sukses root dan berjalan dengan lancar di handphone tertentu. Jika bisa tolong rilis supersu untuk semua android smua mediatek hanya dengan satu klik. Terimakasih

Javier Anselmi commented on 2016-05-26 at 15:45:

Hola q pasa si no actualizó los binarios

Raul Castillo commented on 2016-05-26 at 18:08:

This is why I have purchased all your Pro versions. Simply incredible.

Arthur Lord commented on 2016-05-28 at 20:06:

Please someone help. I cant find the back up of boot.img becouse twrp doesent even read my internal storage.. how what?

Patrick Meloni commented on 2016-05-28 at 21:17:

Hi All, Iam a Little confused. Since 2 Weeks I lost the Root Access over Supersu (Galaxy S7). The Galaxy S5 is still running fine.  Now I don't know if I have to do somthing or just wait until +Chainfire will update as mentioned. I don't want to wreck up all my Setting. Or is the update already published, and I have to flash the new Zip? Thank you for the help......

ANDROID FON commented on 2016-05-29 at 17:20:

over Supersu (Galaxy S7). The Galaxy S5 is still running fine. Now I don't know if I have to do somthing or just wait until +Chainfire will update as mentioned. I don't want to wreck up all my Setting. Or is the update already published, and I have to flash the new Zip? Thank you for the help......

Christian Gupit commented on 2016-05-30 at 08:34:

Why my superSU binary I don't update I try everything

Ali tube commented on 2016-05-30 at 11:03:

قمر

Abo ALoOoL commented on 2016-05-30 at 12:56:

Thanks for you

talha ansari commented on 2016-05-30 at 18:20:

Irctc

Patrick Meloni commented on 2016-05-30 at 20:02:

+Jonathan L Hi Jonathan, I did download it but I sys just that the phone is not rooted. Do you mean I sould Root my Phone again with Supersu? Like I did before It stoped working. with the new policy

murat yarali commented on 2016-06-01 at 04:14:

Cok sacma hic bir ise yaramiyor program

حسن حسن commented on 2016-06-01 at 05:35:

لاتفهم

حسن حسن commented on 2016-06-01 at 13:38:

Fttrerr

Ttrtfgekidifndieffjf  r3kr8fjf fmdjxucifm

مرسل من الهاتف المحمول Samsung

-------- الرسالة الأصلية --------

Thomas Chandra commented on 2016-06-02 at 04:03:

My situation SAMSUNG S7 EDGE SM-G935F (LOST ROOT)

  1. Rooted using CF-AUTOROOT only (No TWRP)

  2. Lost Root

  3. Trying to re-root using Odin 3.11.1 and newest CF-AUTOROOT (CF-Auto-Root-hero2lte-hero2ltexx-smg935f.zip)

  4. Odin say PASS

  5. Rootchecker say nope! Not rooted. Sorry!

What I am doing wrong here?

edit :

I manage re-root (No TWRP), here is how:

  1. Go to sammobile and download firmware with same PDA version

  2. Unzip the firmware. You will have 5 files (AP_g935XXX, BL_, CP_, CSC_, and HOME_). You will need AP_935XXXX file only.

  3. Put your cellphone into recovery mode, and flash the AP_G935XXXXXXX.tar.md5 using Odin.

  4. reboot then flash the latest CF-AUTOROOT

done

Praful Kothari commented on 2016-06-02 at 07:54:

Hey guys i just installed the latest beta zip of supersu v2.74 systemless on my note 2 running resurrection remix rom 5.6.9 marshmallow 6.0.1(performed clean flash)(also after installing the zip wiped dalvik and cache)<br />

<br />

<br />

While i installed i saw that it was written system mode along with disabling ota(sorry i forgot to copy the log) .<br />

So does it means that i have system supersu instead of systemless supersu ?<br />

Because i need systemless supersu su so that i can install systemless xposed framework <br />

<br />

✌

Birsen Dinler commented on 2016-06-02 at 15:47:

+Thomas Chandra Have the same problem with Note 4 N910F 6.0.1

Nathan Royce commented on 2016-06-03 at 23:23:

I'm curious, will Android-Pay and SuperSU be playing an endless game of "cat-and-mouse"?

My first experience was needing to disable SuperSU, rebooting, then re-adding my payment cards (seems they were cleared out).

My next experience was that all I needed to do was just disable SuperSU.

My most recent experience didn't care that SuperSU was disabled, even when I rebooted.

It would be nice to just have my cake and be able to eat it.

Luis Ortega commented on 2016-06-09 at 01:34:

barcelona

Luis Ortega commented on 2016-06-09 at 01:35:

hola

Praful Kothari commented on 2016-06-09 at 02:22:

+Birsen Dinler

+Thomas Chandra​

Try flashing twrp3.0.2.0.tar.gz via odin.

Then boot into recovery and flash this supersu zip v2.74

Rodrigo Sebastian Garcia Garcia commented on 2016-06-09 at 13:28:

Hello

Good Morning

the program will not uninstall SuperSU in zip

aldy rahman commented on 2016-06-09 at 16:35:

Gimana caranya unroot samsung ace3 mohon penjelasan nya

Thomas Chandra commented on 2016-06-10 at 10:43:

How I re-root my GS7 edge :

  1. Go to sammobile and download firmware with same PDA version

  2. Unzip the firmware. You will have 5 files (AP_g935XXX, BL_, CP_, CSC_, and HOME_). You will need AP_935XXXX file only.

  3. Put your cellphone into recovery mode, and flash the AP_G935XXXXXXX.tar.md5 using Odin.

  4. reboot then flash the latest CF-AUTOROOT using Odin

Siddharth Jadav commented on 2016-06-11 at 15:36:

Does the v2.74 support systemless root on MM?

aldy rahman commented on 2016-06-11 at 17:28:

Cara mengembalikan hp yg sudah di root ke versi pabrik gimana ya... tolong kasih tau dongg

Harsh Shandilya commented on 2016-06-12 at 14:25:

+Tommy Bray you exaggerate when you say 2%. More like 0.2%

Ali Erkan commented on 2016-06-13 at 17:36:

Last empire war z için lütfen bana bir hile uygulaması öneriniz

Ali Erkan commented on 2016-06-13 at 17:37:

?

Cristian Zomparelli commented on 2016-06-13 at 19:29:

hi +Chainfire is there a documentation for shell commands / flags supported by SuperSu (e.g. set permissive, disable forceencryption). Thanks!

Ali Erkan commented on 2016-06-13 at 19:59:

Hi

abosalman 007 commented on 2016-06-15 at 17:19:

Good

David Korths commented on 2016-06-15 at 21:24:

Hi

mc hack commented on 2016-06-17 at 01:02:

gmail adris

Arben Krasniqi commented on 2016-06-19 at 15:59:

Hahahaha

Ali Erkan commented on 2016-06-19 at 18:05:

Hack programı yok mu?

Ali Erkan commented on 2016-06-19 at 18:05:

Last empire war z için hile programı var mı ?

Wisnu Afrianto commented on 2016-06-21 at 08:56:

I cant root Android 6.0 on Lenovo a7000-a with supersu v2.74beta , i flash with twrp recovery & stock boot img,,, its says error while repacking ramdisk

Harvey Torres Rocha commented on 2016-06-22 at 03:55:

Buena

Wisnu Afrianto commented on 2016-06-22 at 10:05:

+Man Loki supersu version 2.46 flash via twrp ... Instalasi twrp via spft

Wisnu Afrianto commented on 2016-06-22 at 10:08:

+Praful Kothari system mode it means itsnot in systemless mode , system mode mean su flash in system partition not on boot

Wisnu Afrianto commented on 2016-06-22 at 10:11:

+Arpan Deb you need supersu ,,, kingroot just make you get controlling system with half access

Như Lê commented on 2016-06-29 at 04:58:

help me root device OBI SF1 :(

Wisnu Afrianto commented on 2016-06-29 at 19:40:

What device you have???

Wisnu Afrianto commented on 2016-06-29 at 19:44:

+aldy rahman unroot via apk supersu/superuser

Như Lê commented on 2016-06-30 at 03:09:

+Wisnu Afrianto OBI SF1, please!

Alaikal Faz commented on 2016-06-30 at 23:31:

Update SuperSU work juga nggak di samsung galaxy young gt-s6310, saya pakai superSU versi lawas.

Allex Del Mundo commented on 2016-07-01 at 03:27:

can you please help me to install thr supersu binary update?

Wisnu Afrianto commented on 2016-07-01 at 10:29:

+Như Lê try to boot into recovery mode and flash su zip, or you can try with kingroot apk firstly ... After succed try to unlock bootloader, and then you can flash recovery image such CWM or TWRP. If your device not on the list try custom recovery,,, remove kingroot,,, and boot your phone into recovery mode to flash su zip...

Wisnu Afrianto commented on 2016-07-02 at 17:25:

Just wait one week till i get to my laptop ok,,, i will send file to you

,,, now iam on vacation...

Như Lê commented on 2016-07-05 at 06:22:

+Wisnu Afrianto ok tks u, my email: lengocnhubu@gmail.com

Ramin Danesh commented on 2016-07-10 at 16:37:

Good

sariredjo stephany commented on 2016-07-21 at 13:38:

Sent my a new sofwers update for LG

Selim Şamlı commented on 2016-07-25 at 15:29:

Please Update SM-A310F Marshmallow 6.0.1 For AutoRoot

Manu Mahendran commented on 2016-07-26 at 05:50:

How can I replace kingroot with super su

Clasmo koplak commented on 2016-08-03 at 23:51:

How to instal super su in asus zenfone go z00vd if my phone use kingroot ?

nhulan nguyen commented on 2016-08-06 at 08:00:

I don't understand

Susanto Danu commented on 2016-08-12 at 11:29:

Good

Maalek Shah commented on 2016-08-17 at 19:30:

سلام

Maalek Shah commented on 2016-08-17 at 19:31:

+Như Lê

STIG NOKIAN commented on 2016-08-18 at 18:38:

При

Daniel Ring commented on 2016-08-21 at 04:02:

SM-N910T android 6.0 dl when out ?

Jesse Larpenter commented on 2016-09-01 at 11:14:

I have been using auto root for SM-T377P for my SM-T377R4 Tab, as the specs are almost identical. I really need an auto root update for one or the other. It would be most appreciated!

This post is over a month old, commenting has been disabled.