Termux-packages: tcsetattr fails when running apt in Android 8.0

[txoof]

The following error shows up whenever a package is installed or removed:
E: Setting in Start via TCSAFLUSH for stdin failed! - tcsetattr (13: Permission denied)
Same problem exists for pkg and apt tools

-bash-4.4$ pkg uninstall termux-api
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following packages will be REMOVED:
termux-api
0 upgraded, 0 newly installed, 1 to remove and 0 not upgraded.
After this operation, 152 kB disk space will be freed.
Do you want to continue? [Y/n] y
E: Setting in Start via TCSAFLUSH for stdin failed! - tcsetattr (13: Permission denied)
(Reading database ... 1854 files and directories currently installed.)
Removing termux-api (0.24) ...

output from termux-info:
-bash-4.4$ termux-info
android.os.DeadObjectException: Transaction failed on small parcel; remote process probably died
at android.os.BinderProxy.transactNative(Native Method)
at android.os.BinderProxy.transact(Binder.java:748)
at android.os.BinderProxy.shellCommand(Binder.java:802)
at com.android.commands.pm.Pm.runShellCommand(Pm.java:334)
at com.android.commands.pm.Pm.runList(Pm.java:722)
at com.android.commands.pm.Pm.run(Pm.java:138)
at com.android.commands.pm.Pm.main(Pm.java:107)
at com.android.internal.os.RuntimeInit.nativeFinishInit(Native Method)
at com.android.internal.os.RuntimeInit.main(RuntimeInit.java:284)
Termux version:
<=0.48
Installed Termux apps:
Updatable packages:
All packages up to date
System information:
Linux localhost 3.18.52-g06de20685970 #1 SMP PREEMPT Fri Jun 23 19:50:11 UTC 2017 aarch64 Android
Termux-packages arch:
aarch64
Android version:
8.0.0
Device manufacturer:
Google
Device model:
Pixel

[xeffyr]

You are using Android 8.0, so possible that security features of Android are blocking some calls.

[fornwall]

• It seems to be an Android 8.0 problem.
• It doesn't prevent apt from working, as the package is still installed.
• We seem to be hitting this line in apt: dpkgpm.cc:1283
• tcsetattr with TCSAFLUSH is not completely disallowed in 8.0, as can be tested with:

#include <stdio.h>
#include <termios.h>
#include <unistd.h>

int main() {
        int fd = STDOUT_FILENO;
        struct termios attrs;
        if (tcgetattr(fd, &attrs) != 0) {
                perror("tcgetattr()");
                return 1;
        }
        if (tcsetattr(fd, TCSAFLUSH, &attrs) != 0) {
                perror("tcsetattr()");
                return 1;
        }
        return 0;
}

[fornwall]

Actually, I seem to hit permission denied with tcsetattr in the above example when running on a Nexus 6p running Android 8.1 now.

[fornwall]

The current apt package has the failing tcsetattr disabled for now to avoid the error message on each apt usage.

[y2kbugger]

This is affecting pipenv/pexpect also. Do we need to talk to Google upstream was this intentional and required?

https://github.com/pypa/pipenv/issues/1863

[cgmojoco]

I use Termux/Django/Heroku and need to be able to use pipenv shell.

Apologies for adding clutter, but this effectively puts a block to my ability to develop on the move using my Samsung Note8 (Oreo).

Any expedite appreciated in advance!

[markpizz]

It seems that tcsetattr() with option TCSAFLUSH certainly fails with permission denied. Merely changing TCSAFLUSH to TCSANOW and it doesn't fail. Such a change will be fine for many uses but not all.

[y2kbugger]

I've found that running pipenv run bash works fine it doesn't decorate
prompt but otherwise works.

On Wed, May 9, 2018, 06:29 Mark Pizzolato [e-mail] wrote:

It seems that tcsetattr() with option TCSAFLUSH certainly fails with
permission denied. Merely changing TCSAFLUSH to TCSANOW and it doesn't
fail. Such a change will be fine for many uses but not all.

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
https://github.com/termux/termux-packages/issues/1359#issuecomment-387695750,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AF0araBLp6y-dW7IYRu_NRnWMGF2yO62ks5twsUHgaJpZM4PNbbZ
.

[xeffyr]

Closing since there is a "system-wide" fix now: https://github.com/termux/termux-packages/commit/b5219f720c45ac5b7c29f6bfc4de9c0232aada6d.

[markaljhon]

hi,
how to fix this exactly?
I mean step by step.
Sorry, but it sounds unclear to me.
thank you for your response.

got the same error while installing git on ubuntu.

[xeffyr]

@markaljhon Topic is related to Termux and was fixed.

In Ubuntu there no fix (Ubuntu doesn't compatible with Android), so you will need to patch all affected packages, by replacing TCAFLUSH with TCSANOW and recompiling them.

[markaljhon]

@xeffyr Thank you for your response.

[aristarh2704]

Problem in different predefined constants in bionic and libc: for example, TCSAFLUSH in bionic is 0, while in libc it's equal 2.

[xeffyr]

We redefined it intentionally. Now TCSAFLUSH == TCSANOW to finally fix the issue.

Related commit: https://github.com/termux/termux-packages/commit/b5219f720c45ac5b7c29f6bfc4de9c0232aada6d

TCSAFLUSH (value "2") is forbidden by SELinux.

[remo7777]

i m aslo facing same problem on proot ubuntu and kali fs

[xeffyr]

ubuntu and kali fs

Patching packages inside Ubuntu is going beyond Termux scope.

[xeffyr]

You may open issue regarding TCSAFLUSH in proot repo - https://github.com/termux/proot.

Since TCSAFLUSH is set via

ioctl(fd, TCSETS+TCSAFLUSH /* values: 0x5402+2 */, &term)

it should be possible to modify proot to replace ioctl arguments to something like:

ioctl(fd, TCSETS+TCSANOW /* values: 0x5402+0 */, &term)

[zhanghai]

Note that mksh (the shell shipped on Android) uses TCSADRAIN, which may be a better alternative to TCSANOW when replacing TCSAFLUSH.

man tcsetattr:

  TCSANOW
         the change occurs immediately.

  TCSADRAIN
         the change occurs after all output written to fd has been trans‐
         mitted.  This option should be  used  when  changing  parameters
         that affect output.

  TCSAFLUSH
         the  change  occurs  after  all output written to the object re‐
         ferred by fd has been transmitted, and all input that  has  been
         received  but  not  read  will be discarded before the change is
         made.

Additionally, the SELinux denial message for me on an API 30 emulator was:

2020-11-07 18:17:42.674 20909-20909/system_process W/main: type=1400 audit(0.0:763): avc: denied { ioctl } for path="/dev/pts/0" dev="devpts" ino=3 ioctlcmd=0x5404 scontext=u:r:shell:s0 tcontext=u:object_r:devpts:s0 tclass=chr_file permissive=0

Maybe we should get it fixed for the shell user.

[xeffyr]

avc: denied { ioctl } for path="/dev/pts/0" dev="devpts" ino=3 ioctlcmd=0x5404 scontext=u:r:shell:s0 tcontext=u:object_r:devpts:s0 tclass=chr_file permissive=0

Maybe we should get it fixed for the shell user.

shell user belongs to ADB but Termux has nothing to do with ADB and its SELinux context. Thus not eligible for fixing as we cannot do anything with shell or things related to it.

[zhanghai]

Oh sorry, I was debugging this under the shell user for a WIP toy of mine, and came across this issue, so I incorrectly mentioned the shell user. In fact a platform fix should benifit all processes, if my understanding is correct. I've uploaded a fix at aosp/1491378 and tested that it works.

And yes, one can not backport non-security platform changes, so apps will still have to work around this on Android 8.0 to 11, until they have minSdkVersion 31 🙁 But still, maybe TCSADRAIN is a better alternative to TCSAFLUSH than TCSANOW even on these broken platforms.

UPDATE:

The issue has been fixed by aosp/1491378 and will be available in the next Android release.