Superuser Client & Architecture

MagiskSU (su) Developer Reference

Developer reference for MagiskSU (the su binary), Magisk's isolated, multi-user privilege elevation daemon. Covers command-line arguments, Mount Master mode (--mount-master), socket IPC, and programmatic root execution.

MagiskSU Security Architecture

MagiskSU communicates with the central magiskd daemon via a secure UNIX domain socket (/data/adb/magisk/magisk64). The client process passes the calling application's UID and PID to the daemon, which verifies authorization against SQLite settings (/data/adb/magisk.db), transitions SELinux domain to u:r:magisk:s0, and forks the elevated shell.

CLI Command Syntax & Flags

su Binary Usage

# Start an interactive root shell: $su # Execute a single command and return: $su -c "setenforce 1" # Mount Master Mode (Execute in global init mount namespace): $su -M -c "ls /mnt/runtime/default" $su --mount-master # Isolated Mount Namespace (Changes do not affect other processes): $su -mm # Print MagiskSU version string / code: $su -v $su -V

Understanding Mount Master Mode (`--mount-master` / `-M`)

On Android, every application and process runs within an isolated Linux Mount Namespace. Standard mounts executed in normal su are invisible to other apps. Using su --mount-master (or su -M) forces the root shell into the root init namespace, granting full access to all dynamic storage mounts, loop devices, and external SD cards.

Programmatic Root Integration for Android Apps

To execute root commands reliably within Android applications via Java/Kotlin:

Java ProcessBuilder Pattern

Process process = new ProcessBuilder("su", "-c", "echo 'Root Verified'").start(); BufferedReader reader = new BufferedReader(new InputStreamReader(process.getInputStream())); String output = reader.readLine(); int exitCode = process.waitFor();

MagiskSU Daemon IPC Architecture & Security Model

Unlike legacy SuperSU or CyanogenMod root implementations that relied on setuid-root binaries placed directly in /system/xbin/su, modern Android enforces strict SELinux controls and nosuid mount flags on userspace storage partitions. MagiskSU solves this via client-server IPC architecture.

When an application executes su, the client binary does not possess elevated privileges. Instead, it connects over a secure Unix domain socket (/dev/pts socket connection) to the persistent magiskd daemon running in the u:r:magisk:s0 root domain. The daemon performs three critical security validations before granting root privileges:

Caller UID Verification: Queries the Linux kernel via SO_PEERCRED to determine the exact Linux UID of the calling process, completely preventing UID spoofing.
Database Policy Check: Consults Magisk's internal SQLite policy database located at /data/adb/magisk.db to check whether the UID has been granted permanent root access, temporary access, or denied.
Interactive Superuser Request: If no existing policy is recorded, the daemon signals the Magisk Manager application via an encrypted Binder intent to render the interactive granting dialog to the user with a 10-second timeout.

Querying Active Root Permissions via CLI

# Inspect MagiskSU policies directly from SQLite database: $sqlite3 /data/adb/magisk.db "SELECT uid,package_name,policy,until FROM policies;"