Android
Read-write system partitionRoot
Parses /proc/self/mounts for system partitions mounted read-write.
At a glance
- Platform
- Android
- Category
- Root
- Source
- IntegrityChecks.kt · checkRootRwSystem
- Default status
- Makes status compromised
- Seen firing
- Seen firing in S11. Based on validated scenarios whose observed result includes this signal; see below.
- OWASP MASTG
- MASTG-TEST-0045, MASTG-TEST-0050
How it works
What the code inspects.
Reads /proc/mounts and flags any of /system, /system/bin, /system/xbin, /vendor, /sbin, /etc mounted with the rw option.
On a stock device these partitions are mounted read-only; a rw mount means someone remounted the system to modify it — the classic (pre-systemless) rooting step.
The exploit it addresses
Why this matters.The threat.
A writable system partition lets an attacker replace system binaries, install persistent backdoors, or patch libraries every app loads. Read-only system is a core Android integrity guarantee.
How it can be bypassed
No single check is sufficient.Known evasions.
Magisk's entire design is systemless — it never remounts /system rw, mounting changes through an overlay in /data instead, so this check does not fire on a modern Magisk root.
An attacker can remount read-only again immediately after making changes, leaving no rw mount at the moment of the check.
It reads the app's own mount view. adb remount on a development device changes the shell's view only — zygote and every app keep /system read-only — so it doesn't fire then. It does fire once /system is writable in the app's namespace (verified in scenario S11).
Validation scenarios
Where this check is exercised.2 scenarios.
References & further reading
- MASTG-TEST-0045: Testing Root Detection (Android)Open ↗
https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0045/
- proc_mounts(5) — /proc/self/mountsOpen ↗
https://man7.org/linux/man-pages/man5/proc_mounts.5.html
- How Magisk works (systemless root, MagiskHide history)Open ↗
https://topjohnwu.github.io/Magisk/details.html
- Android Verified BootOpen ↗
https://source.android.com/docs/security/features/verifiedboot