hmz007
36ed224bac
Signed-off-by: hmz007 <hmz007@gmail.com> Change-Id: Ib87fdbe7a0be7dc961af3500fe9ea4589a127f9f
34 lines
853 B
Markdown
34 lines
853 B
Markdown
# shell-as
|
|
|
|
shell-as is a utility that can be used to execute a binary in a less privileged
|
|
security context. This can be useful for verifying the capabilities of a process
|
|
on a running device or testing PoCs with different privilege levels.
|
|
|
|
## Usage
|
|
|
|
The security context can either be supplied explicitly, inferred from a process
|
|
running on the device, or set to a predefined profile.
|
|
|
|
For example, the following are equivalent and execute `/system/bin/id` in the
|
|
context of the init process.
|
|
|
|
```shell
|
|
shell-as \
|
|
--uid 0 \
|
|
--gid 0 \
|
|
--selinux u:r:init:s0 \
|
|
--seccomp system \
|
|
/system/bin/id
|
|
```
|
|
|
|
```shell
|
|
shell-as --pid 1 /system/bin/id
|
|
```
|
|
|
|
The "untrusted-app" profile can be used to execute a binary with all the
|
|
possible privileges attainable by an untrusted app:
|
|
|
|
```shell
|
|
shell-as --profile untrusted-app /system/bin/id
|
|
```
|