Restore the INET group patch on the manager's original gid array - #795
Merged
Conversation
The parasitic manager lives inside com.android.shell, and uid 2000 has no INTERNET permission before Android 12, so we grant it ourselves: the zygisk module appends the INET group to the gid array in preAppSpecialize. That is enough for setgroups(), but not for everything. As soon as nativeForkAndSpecialize returns, Zygote#forkAndSpecialize runs NetworkUtils.setAllowNetworkingForProcess(containsInetGid(gids)); against the array it passed in, which is not the one we substituted, so it concludes that we have no network access. The flag it sets lives in libnetd_client and gates the process from the inside: with it off, dns_open_proxy() and socket() return EPERM whatever groups we really belong to. getaddrinfo then falls back to local resolution, fails as EAI_NODATA with errno EPERM, and libcore turns that into "Permission denied (missing INTERNET permission?)". The unchecked SecurityException kills the OkHttp dispatcher thread and the manager with it. LSPosed patched the caller's array too, ever since the commit that introduced the parasitic manager, and I dropped that one line while rewriting the module for the new zygisk architecture. Nothing broke on Android 12 and later because com.android.shell gained INTERNET there, so the gid array already carries the group and our patching is redundant. On Android 11 and below it is the only thing that works. Fixes#636
JingMatrix
commented
Jul 27, 2026
OwnerAuthor
The history of this line, for the record:
The line never carried a comment saying what it was for, which is probably why it looked redundant to me at the time. It has one now. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The manager runs inside
com.android.shell, which has no INTERNET permission before Android 12, so we add the INET group ourselves during zygote specialization. We were patching only the gid array that the native specialization uses; the array Java keeps holding is the oneZygote#forkAndSpecializereads a moment later to decide whether the process is allowed to use the network. It still said no, so every socket and DNS query inside the manager failed withEPERM, which surfaces asSecurityException: Permission denied (missing INTERNET permission?).LSPosed patched both arrays ever since the parasitic manager was introduced, and I dropped that line while rewriting the module for the new zygisk architecture. Android 12 and later were never affected, because
com.android.shelldeclares INTERNET there and the gid array already carries the group.This is still a hypothesis until it is confirmed on a device. If it holds, it should also explain the empty Repository tab: the manager simply had no network at all.
Fixes#636