UBports install fails with permission error on the device

PhAndersson · 15 Oct 2021, 08:01

Still trying to follow the recommended installation procedure on the Mi A2, but no joy! I've successfully flashed Android9 to both slots, and I'm now attempting the Ubuntu Touch installation through the UBports installer (with v0.8.8, as there seems to be a consensus around that one). The installer terminates in error during its second step, though. It successfully flashes the firmware partition, and I'm able to reboot the phone to the new recovery mode.

The installer reconnects to the phone and proceeds with the 2nd step. It downloads several files to the PC, then starts executing a set of setup commands on the phone, and that's where it turns ugly. I get a big "Yikes!" dialog box, and the following messages on the console:

$ ./ubports-installer
info: Welcome to the UBports Installer version 0.8.8-beta!
warn: Please update: https://devices.ubuntu-touch.io/installer/?package=AppImage
info: device selected: jasmine_sprout
info: Installing Ubuntu Touch on your Xiaomi Mi A2 (jasmine_sprout)
info: configuring...
info: settings: {"channel":"16.04/arm64/android9/stable","wipe":false,"bootstrap":true}
info: Downloading 9 files
info: Downloaded file 1 of 9
info: Downloaded file 2 of 9
info: Downloaded file 3 of 9
info: Downloaded file 4 of 9
info: Downloaded file 5 of 9
info: Downloaded file 6 of 9
info: Downloaded file 7 of 9
info: Downloaded file 8 of 9
info: Downloaded file 9 of 9
error: Error: adb:preparesystemimage: Error: {"error":{"code":1,"cmd":"adb -P 5037 shell mkdir -p /cache/recovery"},"stderr":"mkdir: '/cache/recovery': Operation not permitted"}
stack trace: Error: {"error":{"code":1,"cmd":"adb -P 5037 shell mkdir -p /cache/recovery"},"stderr":"mkdir: '/cache/recovery': Operation not permitted"}
    at /tmp/.mount_ubportvjiIvO/resources/app.asar.unpacked/node_modules/promise-android-tools/lib/module.cjs:117:20
    at ChildProcess.exithandler (child_process.js:319:5)
    at ChildProcess.emit (events.js:315:20)
    at maybeClose (internal/child_process.js:1021:16)
    at Socket.<anonymous> (internal/child_process.js:443:11)
    at Socket.emit (events.js:315:20)
    at Pipe.<anonymous> (net.js:674:12)
info: Good bye!

(I can provide the full installer log if necessary)

Something else that I've noticed and that bothers me is: before attempting the UT install, the phone boots Android9 without issue, but the WiFi cannot be turned ON (the slider reacts, but jumps back to OFF by itself), and in the "advanced" properties, the MAC address is reported as "02:00:00:00:00:00" (which is obviously bogus) => I guess that 'jasmine_sprout_stock_android9.zip' doesn't contain the correct WiFi driver for my device.

is this expected behaviour? or irrelevant to the rest of the installation process?
or would UT also rely on those same drivers to access the HW?

=> are there different "versions" of the Mi A2 out there? Should I attempt to update Android9 over 4G before attempting the UT install?

PhAndersson · 16 Oct 2021, 09:06

Further troubleshooting results. I've attempted the installation again (UTI v0.8.8 as earlier). Flashing recovery and rebooting to it still succeeds, but installation proper still fails with the same error message.

But this time, I closed the installer window, left the phone at the recovery screen, and entered an "adb shell" on the phone to investigate:

$ ./adb devices -l
* daemon not running; starting now at tcp:5037
* daemon started successfully
List of devices attached
dbXXXX                 recovery usb:2-1 product:jasmine model:Mi_A2 device:jasmine_sprout transport_id:1

$ ./adb shell
root@jasmine_sprout:/ # id
uid=0(root) gid=0(root) groups=0(root),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc),3011(uhid)

(first important point I noticed: when the phone is in "UT recovery", the adb shell opens as root -- when I tried with the phone booted on Android9, the shell opened as user 'shell' (uid=2000) -- so this looked promising at first).

But then:

root@jasmine_sprout:/ # ls -al
total 3112
drwxr-xr-x  23 root   root         900 1972-12-08 05:51 .
drwxr-xr-x   3 root   root        4096 2021-10-16 08:08 ..
dr-xr-xr-x   3 root   root           0 1972-12-08 05:51 acct
lrwxrwxrwx   1 root   root          11 1972-12-08 05:51 bin -> /system/bin
lrwxrwxrwx   1 root   root          19 1972-12-08 05:51 bt_firmware -> /vendor/bt_firmware
lrwxrwxrwx   1 root   root          50 1972-12-08 05:51 bugreports -> /data/user_de/0/com.android.shell/files/bugreports
drwxrwx---   2 system cache       4096 1972-12-08 05:52 cache
drwxr-xr-x   4 root   root           0 1970-01-01 00:00 config
[...]

So the 'cache/' folder already exists, is owned by 'system:cache' and mode 770. Since I'm root, this should be no blocker. Still:

root@jasmine_sprout:/ # cd cache/                                              
root@jasmine_sprout:/cache # ls -al
total 12
drwxrwx--- 2 system cache 4096 1972-12-08 05:52 .
drwxr-xr-x 3 root   root  4096 2021-10-16 08:08 ..
root@jasmine_sprout:/cache # touch brol
touch: 'brol': Operation not permitted
1|root@jasmine_sprout:/cache # mkdir recovery
mkdir: 'recovery': Operation not permitted

I'm allowed to enter the folder, but I'm unable to create either file or subfolder there. Strange.

Just to make sure:

root@jasmine_sprout:/ # mount
sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,relatime)
proc on /proc type proc (rw,nosuid,nodev,noexec,relatime,gid=3009,hidepid=2)
udev on /dev type devtmpfs (rw,nosuid,relatime,size=1749428k,nr_inodes=437357,mode=755)
devpts on /dev/pts type devpts (rw,nosuid,noexec,relatime,mode=600,ptmxmode=000)
tmpfs on / type tmpfs (rw,relatime,size=1891232k,nr_inodes=472808)
[...]
/dev/block/mmcblk0p69 on /cache type ext4 (rw,relatime,discard,nodelalloc,resgid=1065,data=journal)
/dev/block/mmcblk0p65 on / type ext4 (rw,relatime,stripe=2,data=ordered)
[...]

both root filesystems and '/cache' are mounted in RW mode, so that's not the issue.

I also tried switching to the 'system' group:

1|root@jasmine_sprout:/cache # newgrp - system
/sbin/sh: newgrp: not found

but that command is not available.

In the shell session I opened earlier, when the phone was still booted under Android9, I noticed that SELinux was used, so there must be an extra layer of protection. Is this what's getting in the way?

Can anyone offer advice on how to debug this further?

PhAndersson · 16 Oct 2021, 10:45

Also:

1|root@jasmine_sprout:/ # cd /etc                                              
root@jasmine_sprout:/etc # ls -l passwd group                                  
ls: passwd: No such file or directory
ls: group: No such file or directory

And "find / -type f -name group" doesn't turn up anything either. So adding root to the "cache" group doesn't seem trivial.

PhAndersson · 16 Oct 2021, 11:25

Something else that might have its importance, come to think of it:

root@jasmine_sprout:/ # uname -a
Linux localhost 4.4.250-Xiaomi_SDM660-LA.UM.8.2.r1-06200+ #1 SMP PREEMPT Mon Jul 12 11:19:34 UTC 2021 aarch64

PhAndersson · 23 Oct 2021, 12:05

OK, yet more troubleshooting. I brought the phone back up to the same state (or as close to it as possible) as it was at the time the UPI failed. This is the sequence I followed:

boot phone to recovery from power off state
$ ./adb shell

# mount -a (same FS mounted as after UPI install attempt)
# cd cache (dir is still empty)
# mkdir recovery => "Operation not permitted"

Using 'dmesg', I found the kernel command-line that was used to boot the device, and among the parameters I noticed the following ones (extract):

selinux=0 apparmor=1 security=apparmor androidboot.verifiedbootstate=orange androidboot.veritymode=enforcing

So SELinux appears disabled, while AppArmor is active. Still, being denied the right to create a new folder doesn't trigger any alert in 'dmesg' (either by SELinux or AppArmor). Some Android docs mention a 'logcat' command, but it doesn't seem present in this environment.

Something else I found out (through the 'mount' output), the same block device appears to be mounted twice on different mountpoints:

/dev/block/mmcblk0p69 on /cache type ext4 (rw,relatime,discard,nodelalloc,resgid=1065,data=journal)
/dev/block/mmcblk0p69 on /data type ext4 (rw,relatime,discard,nodelalloc,resgid=1065,data=journal)

...and a script called '/setup_fake_cache.sh' contains the following commands:

mkdir /data/cache > /dev/kmsg
mount -o bind /data/cache /cache > /dev/kmsgs

Said folder ('/data/cache') does indeed exist, has the same contents as '/cache' (i.e. they're both empty), has the same rights and ownership as '/cache', and I get the same error message if I attempt to create a new subfolder there.

PhAndersson · 23 Oct 2021, 16:39

OK -- many thanks to "Shou" and "Kisekinopureya" who helped on Telegram.

First suggestion was to run "./fastboot flashing unlock_critical" (after having flashed stock Android 9, but before starting the UPI). That turned out not changing anything.

The second suggestion was to wipe user data and cache using "./fastboot -w" (once again, before starting the UPI), and this did the trick

My phone now happily runs UT!

Alter · 23 Oct 2021, 22:57

@phandersson : Great to hear that it's working now! Hope from now on the road is less bumpy for you.

shockwave · 28 Jan 2022, 06:46

@phandersson said in UBports install fails with permission error on the device:

or would UT also rely on those same drivers to access the HW?

I had the same problem and to solve it, I had to format partition in TWRP and then restart UPI.