Merge pull request 'Fix /data/adb/magisk permissions so Zygisk can initialise' (#284) from MisterWizzard/fix/magisk-data-adb-permissions into main

Reviewed-on: #284

default.nix

@@ -1,22 +1,4 @@
-with (import <nixpkgs> {});
-
-stdenv.mkDerivation {
-  name = "waydroid_script";
-
-  buildInputs = [
-    (python3.withPackages(ps: with ps; [ tqdm requests inquirerpy ]))
-  ];
-
-  src = ./.;
-
-  postPatch = ''
-    patchShebangs main.py
-  '';
-
-  installPhase = ''
-    mkdir -p $out/libexec
-    cp -r . $out/libexec/waydroid_script
-    mkdir -p $out/bin
-    ln -s $out/libexec/waydroid_script/main.py $out/bin/waydroid_script
-  '';
-}
+let
+  pkgs = import <nixpkgs> {};
+in
+  pkgs.callPackage ./package.nix { }

flake.lock

@@ -0,0 +1,41 @@
+{
+  "nodes": {
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1707650010,
+        "narHash": "sha256-dOhphIA4MGrH4ElNCy/OlwmN24MsnEqFjRR6+RY7jZw=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "809cca784b9f72a5ad4b991e0e7bcf8890f9c3a6",
+        "type": "github"
+      },
+      "original": {
+        "id": "nixpkgs",
+        "type": "indirect"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixpkgs": "nixpkgs",
+        "systems": "systems"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

flake.nix

@@ -0,0 +1,21 @@
+{
+  description = "Waydroid Extras Script";
+  inputs = {
+    systems.url = "github:nix-systems/default";
+  };
+  outputs = { self, nixpkgs, systems }:
+  let
+    inherit (nixpkgs) lib;
+    eachSystem = lib.genAttrs (import systems);
+    mkApp = program: { type = "app"; inherit program; };
+  in {
+    packages = eachSystem (system: rec {
+      waydroid_script = nixpkgs.legacyPackages."${system}".callPackage ./package.nix { };
+      default = waydroid_script;
+    });
+    apps = eachSystem (system: rec {
+      waydroid_script = mkApp "${self.outputs.packages.${system}.waydroid_script}/bin/waydroid_script";
+      default = waydroid_script;
+    });
+  };
+}

main.py

@@ -18,7 +18,7 @@ from stuff.nodataperm import Nodataperm
 from stuff.smartdock import Smartdock
 from stuff.widevine import Widevine
 from stuff.fdroidpriv import FDroidPriv
-from stuff.gps import GPS
+from stuff.device_spoof import DeviceSpoof, PROFILES
 import tools.helper as helper
 from tools import container
 from tools import images
@@ -90,8 +90,8 @@ def install_app(args):
         install_list.append(Mitm(args.ca_cert_file))
     if "fdroidpriv" in app:
         install_list.append(FDroidPriv(args.android_version))
-    if "gps" in app:
-        install_list.append(GPS(args.android_version, args.gps_host, args.baud_rate))
+    if "device_spoof" in app:
+        DeviceSpoof(getattr(args, "spoof_profile", "pixel6")).install()
 
     if not container.use_overlayfs():
         copy_dir = "/tmp/waydroid"
@@ -118,7 +118,8 @@ def install_app(args):
     if not container.use_overlayfs():
         umount("vendor", copy_dir)
         umount("system", copy_dir)
-        container.upgrade()
+
+    container.upgrade()
 
 
 def remove_app(args):
@@ -142,12 +143,12 @@ def remove_app(args):
         remove_list.append(Mitm())
     if "fdroidpriv" in app:
         remove_list.append(FDroidPriv(args.android_version))
+    if "device_spoof" in app:
+        DeviceSpoof().uninstall()
     if "nodataperm" in app:
         remove_list.append(Nodataperm(args.android_version))
     if "hidestatusbar" in app:
         remove_list.append(HideStatusBar())
-    if "gps" in app:
-        remove_list.append(GPS())
 
     if not container.use_overlayfs():
         copy_dir = "/tmp/waydroid"
@@ -173,7 +174,6 @@ def hack_option(args):
         hack_list.append(Nodataperm())
     if "hidestatusbar" in options:
         hack_list.append(HideStatusBar())
-    
 
     if not container.use_overlayfs():
         copy_dir = "/tmp/waydroid"
@@ -234,10 +234,7 @@ def interact():
     if not action:
         exit()
 
-
-    install_choices = ["gapps", "microg", "libndk", "libhoudini", "magisk", "smartdock", "fdroidpriv", "widevine", "gps",]
-    baud_rate_choices = ["9600", "19200", "38400", "57600", "115200"]
-
+    install_choices = ["gapps", "microg", "libndk", "libhoudini", "magisk", "smartdock", "fdroidpriv", "widevine", "device_spoof"]
     hack_choices = []
     if android_version=="11":
         hack_choices.extend(["nodataperm", "hidestatusbar"])
@@ -259,20 +256,13 @@ def interact():
                 default="Standard",
             ).execute()
             args.microg_variant = microg_variant
-        if "gps" in apps:
-            gps_host = inquirer.text(
-                message="Enter GPS host (default: /dev/ttyGPSD)",
-                default="/dev/ttyGPSD",
+        if "device_spoof" in apps:
+            spoof_profile = inquirer.select(
+                message="Select device profile to spoof",
+                choices=list(PROFILES.keys()),
+                default="pixel6",
             ).execute()
-            args.gps_host = gps_host
-            baud_rate = inquirer.select(
-                message="Enter baud rate (default: 9600)",
-                instruction="([\u2191\u2193]: [Enter]: Confirm",
-                default="9600",
-                choices=baud_rate_choices
-            ).execute()
-            args.baud_rate = baud_rate
-
+            args.spoof_profile = spoof_profile
         args.app = apps
         install_app(args)
     elif action == "Remove":
@@ -318,7 +308,7 @@ def main():
     certified.set_defaults(func=get_certified)
 
     install_choices = ["gapps", "microg", "libndk", "libhoudini",
-                       "magisk", "mitm", "smartdock", "widevine"]
+                       "magisk", "mitm", "smartdock", "widevine", "device_spoof"]
     hack_choices = ["nodataperm", "hidestatusbar"]
     micrg_variants = ["Standard", "NoGoolag", "UNLP", "Minimal", "MinimalIAP"]
     remove_choices = install_choices
@@ -349,6 +339,11 @@ widevine: Add support for widevine DRM L3
                                 dest='ca_cert_file',
                                 help='[for mitm only] The CA certificate file (*.pem) to install',
                                 default=None)
+    install_parser.add_argument('-p', '--spoof-profile',
+                                dest='spoof_profile',
+                                help='[for device_spoof only] Device profile to spoof',
+                                choices=list(PROFILES.keys()),
+                                default="pixel6")
     install_parser.set_defaults(func=install_app)
 
     # remove and its aliases
@@ -366,8 +361,6 @@ widevine: Add support for widevine DRM L3
 
     args = parser.parse_args()
     args.microg_variant = "Standard"
-    args.gps_host = "/dev/ttyGPSD"
-    args.baud_rate = "9600"
     if hasattr(args, 'func'):
         args_dict = vars(args)
         helper.check_root()

package.nix

@@ -0,0 +1,32 @@
+{ lib,
+  stdenvNoCC,
+  lzip,
+  python3,
+  makeWrapper }:
+let
+  wrappedPath = lib.makeBinPath [ lzip ];
+in stdenvNoCC.mkDerivation {
+  name = "waydroid_script";
+
+  buildInputs = [
+    (python3.withPackages(ps: with ps; [ tqdm requests inquirerpy ]))
+  ];
+
+  nativeBuildInputs = [
+    makeWrapper
+  ];
+
+  src = ./.;
+
+  postPatch = ''
+    patchShebangs main.py
+  '';
+
+  installPhase = ''
+    mkdir -p $out/libexec
+    cp -r . $out/libexec/waydroid_script
+    mkdir -p $out/bin
+    makeShellWrapper $out/libexec/waydroid_script/main.py $out/bin/waydroid_script \
+      --prefix PATH : "${wrappedPath}"
+  '';
+}

stuff/device_spoof.py

@@ -0,0 +1,71 @@
+import configparser
+from tools.logger import Logger
+
+
+PROFILES = {
+    "pixel6": {
+        "ro.product.brand": "google",
+        "ro.product.manufacturer": "Google",
+        "ro.product.model": "Pixel 6",
+        "ro.product.name": "oriole",
+        "ro.product.device": "oriole",
+        "ro.product.board": "oriole",
+        "ro.build.product": "oriole",
+        "ro.build.fingerprint": "google/oriole/oriole:13/TQ3A.230901.001/10750268:user/release-keys",
+        "ro.build.description": "oriole-user 13 TQ3A.230901.001 10750268 release-keys",
+        "ro.build.version.release": "13",
+        "ro.build.version.sdk": "33",
+        "ro.build.type": "user",
+        "ro.build.tags": "release-keys",
+    },
+    "samsung_s21": {
+        "ro.product.brand": "samsung",
+        "ro.product.manufacturer": "samsung",
+        "ro.product.model": "SM-G991B",
+        "ro.product.name": "o1sxeea",
+        "ro.product.device": "o1s",
+        "ro.product.board": "lahaina",
+        "ro.build.product": "o1s",
+        "ro.build.fingerprint": "samsung/o1sxeea/o1s:13/TP1A.220624.014/G991BXXU5EWCA:user/release-keys",
+        "ro.build.description": "o1sxeea-user 13 TP1A.220624.014 G991BXXU5EWCA release-keys",
+        "ro.build.version.release": "13",
+        "ro.build.version.sdk": "33",
+        "ro.build.type": "user",
+        "ro.build.tags": "release-keys",
+    },
+}
+
+PROP_KEYS = list(next(iter(PROFILES.values())).keys())
+
+
+class DeviceSpoof:
+    id = "device_spoof"
+
+    def __init__(self, profile_name="pixel6") -> None:
+        if profile_name not in PROFILES:
+            raise ValueError(f"Unknown profile '{profile_name}'. Choose from: {list(PROFILES.keys())}")
+        self.profile_name = profile_name
+        self.apply_props = PROFILES[profile_name]
+
+    def _read_cfg(self):
+        cfg = configparser.ConfigParser()
+        cfg.read("/var/lib/waydroid/waydroid.cfg")
+        if not cfg.has_section("properties"):
+            cfg.add_section("properties")
+        return cfg
+
+    def install(self):
+        cfg = self._read_cfg()
+        for key, value in self.apply_props.items():
+            cfg.set("properties", key, value)
+        with open("/var/lib/waydroid/waydroid.cfg", "w") as f:
+            cfg.write(f)
+        Logger.info(f"Device spoofed as '{self.profile_name}'. Restart Waydroid to apply.")
+
+    def uninstall(self):
+        cfg = self._read_cfg()
+        for key in PROP_KEYS:
+            cfg.remove_option("properties", key)
+        with open("/var/lib/waydroid/waydroid.cfg", "w") as f:
+            cfg.write(f)
+        Logger.info("Device spoof properties removed. Restart Waydroid to apply.")

stuff/gps.py

@@ -1,197 +0,0 @@
-import os
-from xml.dom import minidom
-import xml.etree.ElementTree as ET
-import shutil
-from stuff.general import General
-from tools.logger import Logger
-import tools.images as images
-from tools.helper import run, host 
-from tools import container
-
-class GPS(General):
-    id = "gps"
-    partition = "vendor"
-    dl_links = ["https://github.com/Lolmc0587/android_gps_libraries/archive/refs/tags/2.1.zip","f84c369c7cebd9dbb8987ca15c6aa856"]
-    act_md5 = ...
-    dl_link = ...
-    dl_file_name = "android_gps_libraries-2.1.zip"
-    extract_to = "/tmp/android_gps_libraries-2.1"
-
-    files = [
-        "lib/hw/android.hardware.gnss@1.0-impl.so",
-        "lib64/hw/android.hardware.gnss@1.0-impl.so",
-        "lib/hw/gps.default.so",
-        "lib64/hw/gps.default.so",
-        "etc/init/android.hardware.gnss@1.0-service.rc",
-    ]
-    
-
-    def __init__(self, android_version="11", gps_host="/dev/ttyGPSD", baud_rate=9600) -> None:
-        super().__init__()
-        self.host_arch = host()
-        # Set for arm 32 bit support from file downloaded 
-        self.host = "arm64-v8a" if "arm" in self.host_arch[0] else self.host_arch[0]
-        self.gps_host = gps_host
-        self.baud_rate = baud_rate
-        self.android_version = android_version
-        self.usb_name = self.gps_host.replace("/dev/", "")
-        self.files_vendor = [
-            "bin/hw/android.hardware.gnss@1.0-service",
-        ]
-        self.config_files = {
-            "11": [
-                "etc/vintf/compatibility_matrix.legacy.xml",
-                "etc/vintf/manifest.xml",
-                "build.prop",
-            ],
-            "13": [
-                "etc/vintf/compatibility_matrix.7.xml",
-                "etc/vintf/manifest.xml",
-                "build.prop",
-            ],
-        }
-    
-        self.compatibility_files = {
-            "11": "etc/vintf/compatibility_matrix.legacy.xml",
-            "13": "etc/vintf/compatibility_matrix.7.xml",
-        }
-
-        self.dl_link = self.dl_links[0]
-        self.act_md5 = self.dl_links[1]
-
-    def update_manifest(self, manifest_path, data):
-        """
-        Update the manifest file by inserting data into the <manifest> tag and format the XML.
-        """
-        tree = ET.parse(manifest_path)
-        root = tree.getroot()
-
-        root.append(ET.fromstring(data))
-        tree.write(manifest_path, encoding="utf-8", xml_declaration=True)
-
-        with open(manifest_path, "r") as f:
-            content = f.read()
-            formatted_content = minidom.parseString(content).toprettyxml(indent="    ")
-
-        formatted_content = "\n".join(
-            [line for line in formatted_content.split("\n") if line.strip()]
-        )
-
-        with open(manifest_path, "w") as f:
-            f.write(formatted_content)
-
-    def copy(self):
-        Logger.info("Copying gps library files ...")
-        if self.android_version == "11":
-            shutil.copytree(os.path.join(self.extract_to, self.dl_file_name.replace(".zip", ""), self.android_version,
-                        self.host, "system"), os.path.join(self.copy_dir, "system"), dirs_exist_ok=True)
-            self.partition = "system"
-        if self.android_version == "13":
-            shutil.copytree(os.path.join(self.extract_to, self.dl_file_name.replace(".zip", ""), self.android_version,
-                            self.host, "system"), os.path.join(self.copy_dir, "vendor"), dirs_exist_ok=True)
-            self.partition = "vendor"
-        shutil.copytree(os.path.join(self.extract_to, self.dl_file_name.replace(".zip", ""), self.android_version,
-                        self.host, "vendor"), os.path.join(self.copy_dir, "vendor"), dirs_exist_ok=True)
-        
-    def extra1(self):
-        Logger.info("Setting extra permissions ...")
-        # set permissions for vendor files
-        path = os.path.join(self.copy_dir, "vendor", self.files_vendor[0])
-        self.set_perm2(path, recursive=True)
-        
-        # Copy nessessary files to the overlayfs
-        container.stop()
-        copy_dir = "/tmp/waydroid"
-        if container.use_overlayfs():
-            img = os.path.join(images.get_image_dir(), "system.img")
-            # images.mount(img, copy_dir)
-            if not os.path.exists(copy_dir):
-                os.makedirs(copy_dir)
-            run(["sudo", "mount", img, copy_dir])
-
-            for file in self.config_files[self.android_version]:
-                file_dir = os.path.join(self.copy_dir, "system", file)
-                if not os.path.exists(os.path.dirname(file_dir)):
-                    os.makedirs(os.path.dirname(file_dir))
-                shutil.copyfile(os.path.join(copy_dir, "system", file), file_dir)
-                self.set_perm2(file_dir, recursive=True)
-
-            if self.android_version == "13":
-                # Copy missing libraries file for android 13 vendor partition from system partition
-                if not os.path.exists(os.path.join(self.copy_dir, "vendor", "lib64", "hw")):
-                    os.makedirs(os.path.join(self.copy_dir, "vendor", "lib64", "hw"))
-
-                copy_ = True
-                if "arm" in self.host and self.host_arch[1] == 32:
-                    copy_ = False
-                if copy_:
-                    shutil.copyfile(os.path.join(copy_dir, "system", "lib64/android.hardware.gnss@1.0.so"),
-                                    os.path.join(self.copy_dir, "vendor", "lib64/hw/android.hardware.gnss@1.0.so"))
-                
-                if not os.path.exists(os.path.join(self.copy_dir, "vendor", "lib", "hw")):
-                    os.makedirs(os.path.join(self.copy_dir, "vendor", "lib", "hw"))
-
-                shutil.copyfile(os.path.join(copy_dir, "system", "lib/android.hardware.gnss@1.0.so"),
-                                os.path.join(self.copy_dir, "vendor", "lib/hw/android.hardware.gnss@1.0.so"))
-                
-            images.umount(copy_dir)
-        
-        # Update manifest files
-        container.upgrade()
-        
-        manifest_entry_1 = """
-            <hal format="hidl" optional="true">
-                <name>android.hardware.gnss</name>
-                <version>1.0</version>
-                <interface>
-                    <name>IGnss</name>
-                    <instance>default</instance>
-                </interface>
-            </hal>
-        """
-        self.update_manifest(
-            os.path.join(self.copy_dir, "system", self.compatibility_files[self.android_version]),
-            data=manifest_entry_1,
-        )
-
-        manifest_entry_2 = """
-            <hal format="hidl">
-                <name>android.hardware.gnss</name>
-                <transport>hwbinder</transport>
-                <version>1.0</version>
-                <interface>
-                    <name>IGnss</name>
-                    <instance>default</instance>
-                </interface>
-                <fqname>@1.0::IGnss/default</fqname>
-            </hal>
-        """
-        self.update_manifest(os.path.join(self.copy_dir, "system", "etc", "vintf", "manifest.xml"), data=manifest_entry_2)
-        config_nodes = "/var/lib/waydroid/lxc/waydroid/config_nodes"
-        # lxc.mount.entry = /dev/ttyGPSD dev/ttyGPSD none bind,create=file,optional 0 0
-
-        with open(config_nodes, "a") as f:
-            f.write(f"lxc.mount.entry = {self.gps_host} dev/{self.usb_name} none bind,create=file,optional 0 0\n")
-
-        with open(os.path.join(self.copy_dir, "system", "build.prop"), "a") as f:
-            f.write("ro.factory.hasGPS=true\n")
-            f.write(f"ro.kernel.android.gps={self.usb_name}\n")
-            f.write(f"ro.kernel.android.gps.speed={self.baud_rate}\n")
-        Logger.warning(
-            "You need to add user to the 'dialout' group to access the GPS device."
-            "\nYou can do this by running: sudo usermod -aG dialout <your_username>"
-            "\nand then reboot your system."
-        )
-    def extra2(self):
-        # Remove vendor files from system partition
-        self.files = self.files_vendor
-        self.partition = "vendor"
-        self.remove()
-
-        # Remove config files from system partition
-        self.files = self.config_files[self.android_version]
-        self.partition = "system"
-        self.remove()
-
-        container.upgrade()
-        

stuff/houdini.py

@@ -10,7 +10,7 @@ class Houdini(General):
     partition = "system"
     dl_links = {
         "11": ["https://github.com/supremegamers/vendor_intel_proprietary_houdini/archive/81f2a51ef539a35aead396ab7fce2adf89f46e88.zip", "fbff756612b4144797fbc99eadcb6653"],
-        "13": ["https://github.com/supremegamers/vendor_intel_proprietary_houdini/archive/7e21ea3f63bd89e9e8af54e32da41bd8b65c93a1.zip", "f8cf5db10e5fdb9b77e98e515a9b08c9"]
+        "13": ["https://github.com/supremegamers/vendor_intel_proprietary_houdini/archive/2f8f088671182e17e67321e098e8411a3972a628.zip", "37fe0899f1e4da7f9a724cca1c1ab1ea"]
     }
     act_md5 = ...
     dl_link = ...

stuff/magisk.py

@@ -64,7 +64,28 @@ on property:init.svc.zygote=stopped
         Logger.info("Additional setup")
         magisk_absolute_dir = os.path.join(self.copy_dir, self.magisk_dir)
         data_dir = get_data_dir()
-        shutil.copytree(magisk_absolute_dir, os.path.join(data_dir, "adb", "magisk"), dirs_exist_ok=True)
+        data_magisk_dir = os.path.join(data_dir, "adb", "magisk")
+        shutil.copytree(magisk_absolute_dir, data_magisk_dir, dirs_exist_ok=True)
+
+        # General.install() calls set_perm() only over self.files, which are paths
+        # under copy_dir (the overlay). This /data/adb copy is made here, before
+        # that runs, so it keeps the 0644 the binaries inherited from the apk
+        # extraction. A non-executable /data/adb/magisk/magisk64 makes magisk_env()
+        # abort at post-fs-data: root still works from the overlay copy, but Zygisk
+        # silently never initialises (Magisk reports "Zygisk: No" no matter what
+        # the zygisk setting says). Apply the same perms set_path_perm() gives
+        # magisk paths, to this copy too.
+        self.set_data_magisk_perm(data_magisk_dir)
+
+    def set_data_magisk_perm(self, data_magisk_dir):
+        if not os.path.isdir(data_magisk_dir):
+            return
+        os.chmod(data_magisk_dir, 0o755)
+        for root, dirnames, filenames in os.walk(data_magisk_dir):
+            for dirname in dirnames:
+                os.chmod(os.path.join(root, dirname), 0o755)
+            for filename in filenames:
+                os.chmod(os.path.join(root, filename), 0o755)
 
     def copy(self):
         magisk_absolute_dir = os.path.join(self.copy_dir, self.magisk_dir)

stuff/nodataperm.py

@@ -10,19 +10,23 @@ from tools import container
 class Nodataperm(General):
     id = "nodataperm"
     dl_links = {
-        "11":
-        {
+        "11": {
+            "x86_64": [
+                "https://github.com/ayasa520/hack_full_data_permission/archive/d4beab7780eb792059d33e77d865579c9ee41546.zip",
+                "b0e3908ffcf5df8ea62f4929aa680f1a"
+            ],
+        },
+        "13": {
             "x86_64": [
                 "https://github.com/ayasa520/hack_full_data_permission/archive/d4beab7780eb792059d33e77d865579c9ee41546.zip",
                 "b0e3908ffcf5df8ea62f4929aa680f1a"
             ],
         },
-        "13": {}
     }
     dl_file_name = "nodataperm.zip"
     extract_to = "/tmp/nodataperm"
-    dl_link = ...
-    act_md5 = ...
+    dl_link = None
+    act_md5 = None
     partition = "system"
     files = [
         "etc/nodataperm.sh",
@@ -36,11 +40,15 @@ class Nodataperm(General):
         super().__init__()
         print("ok")
         arch = self.arch[0]
+        if android_version not in self.dl_links:
+            raise KeyError(f"No download links for Android version '{android_version}'")
+        if arch not in self.dl_links[android_version]:
+            raise KeyError(f"No download links for architecture '{arch}' in Android version '{android_version}'")
         self.dl_link = self.dl_links[android_version][arch][0]
         self.act_md5 = self.dl_links[android_version][arch][1]
 
     def copy(self):
-        name = re.findall("([a-zA-Z0-9]+)\.zip", self.dl_link)[0]
+        name = re.findall(r"([a-zA-Z0-9]+)\.zip", self.dl_link)[0]
         extract_path = os.path.join(
             self.extract_to, f"hack_full_data_permission-{name}")
         if not container.use_overlayfs():

tests/test_magisk_setup_perms.py

@@ -0,0 +1,179 @@
+#!/usr/bin/env python3
+"""Regression test for Magisk.setup() permissions on the /data/adb/magisk copy.
+
+install() runs copy() -> extra1() -> set_perm(). set_perm() only walks self.files,
+which are paths under copy_dir (the overlay), so the copy that setup() makes into
+<data>/adb/magisk keeps the 0644 the binaries inherit from the apk extraction.
+
+A non-executable /data/adb/magisk/magisk64 makes magisk_env() abort at post-fs-data.
+Root still works (it runs from the overlay copy), but Zygisk never initialises and
+the Magisk app reports "Zygisk: No" with no error explaining why.
+
+Runs as an ordinary user, needs no Waydroid install and no extra dependencies:
+
+    python3 tests/test_magisk_setup_perms.py
+"""
+
+import os
+import shutil
+import stat
+import sys
+import tempfile
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+import stuff.magisk as magisk_module
+from stuff.magisk import Magisk
+
+MAGISK_BINARIES = [
+    "magisk64",
+    "magiskinit",
+    "magiskboot",
+    "magiskpolicy",
+    "busybox",
+    "util_functions.sh",
+]
+
+
+def make_overlay(base):
+    """Mimic the tree copy() leaves behind: binaries written 0644 by shutil.copyfile."""
+    magisk_dir = os.path.join(base, "system", "etc", "init", "magisk")
+    os.makedirs(os.path.join(magisk_dir, "chromeos"), exist_ok=True)
+    for name in MAGISK_BINARIES:
+        path = os.path.join(magisk_dir, name)
+        with open(path, "wb") as f:
+            f.write(b"\x7fELF placeholder")
+        os.chmod(path, 0o644)
+    nested = os.path.join(magisk_dir, "chromeos", "futility")
+    with open(nested, "wb") as f:
+        f.write(b"placeholder")
+    os.chmod(nested, 0o644)
+    return magisk_dir
+
+
+def file_modes(root):
+    modes = {}
+    for dirpath, _dirnames, filenames in os.walk(root):
+        for name in filenames:
+            path = os.path.join(dirpath, name)
+            modes[os.path.relpath(path, root)] = stat.S_IMODE(os.stat(path).st_mode)
+    return modes
+
+
+def test_plain_copytree_loses_exec_bit():
+    """Document the original behaviour: a bare copytree leaves the binaries 0644."""
+    base = tempfile.mkdtemp()
+    try:
+        src = make_overlay(base)
+        dst = os.path.join(base, "data", "adb", "magisk")
+        os.makedirs(os.path.dirname(dst), exist_ok=True)
+        shutil.copytree(src, dst, dirs_exist_ok=True)
+
+        modes = file_modes(dst)
+        assert modes["magisk64"] == 0o644, (
+            "expected the pre-fix behaviour to reproduce, got %o" % modes["magisk64"]
+        )
+    finally:
+        shutil.rmtree(base, ignore_errors=True)
+
+
+def test_setup_makes_data_copy_executable():
+    """setup() must leave every file and dir in <data>/adb/magisk executable."""
+    base = tempfile.mkdtemp()
+    try:
+        make_overlay(base)
+        data_dir = os.path.join(base, "data")
+        os.makedirs(data_dir, exist_ok=True)
+
+        original_get_data_dir = magisk_module.get_data_dir
+        original_info = magisk_module.Logger.info
+        magisk_module.get_data_dir = lambda: data_dir
+        magisk_module.Logger.info = lambda *a, **k: None
+
+        class StubMagisk(Magisk):
+            @property
+            def copy_dir(self):
+                return base
+
+        try:
+            StubMagisk().setup()
+        finally:
+            magisk_module.get_data_dir = original_get_data_dir
+            magisk_module.Logger.info = original_info
+
+        dst = os.path.join(data_dir, "adb", "magisk")
+        modes = file_modes(dst)
+        assert modes, "setup() copied nothing"
+
+        not_executable = {n: oct(m) for n, m in modes.items() if m != 0o755}
+        assert not not_executable, "files left non-0755: %s" % not_executable
+
+        assert stat.S_IMODE(os.stat(dst).st_mode) == 0o755
+        nested = os.path.join(dst, "chromeos")
+        assert stat.S_IMODE(os.stat(nested).st_mode) == 0o755, "nested dir not fixed"
+    finally:
+        shutil.rmtree(base, ignore_errors=True)
+
+
+def test_setup_is_idempotent():
+    base = tempfile.mkdtemp()
+    try:
+        make_overlay(base)
+        data_dir = os.path.join(base, "data")
+        os.makedirs(data_dir, exist_ok=True)
+
+        original_get_data_dir = magisk_module.get_data_dir
+        original_info = magisk_module.Logger.info
+        magisk_module.get_data_dir = lambda: data_dir
+        magisk_module.Logger.info = lambda *a, **k: None
+
+        class StubMagisk(Magisk):
+            @property
+            def copy_dir(self):
+                return base
+
+        try:
+            StubMagisk().setup()
+            StubMagisk().setup()
+        finally:
+            magisk_module.get_data_dir = original_get_data_dir
+            magisk_module.Logger.info = original_info
+
+        dst = os.path.join(data_dir, "adb", "magisk")
+        assert all(m == 0o755 for m in file_modes(dst).values())
+    finally:
+        shutil.rmtree(base, ignore_errors=True)
+
+
+def test_perm_helper_tolerates_missing_dir():
+    Magisk().set_data_magisk_perm(os.path.join(tempfile.gettempdir(), "definitely-not-here"))
+
+
+def main():
+    tests = [
+        test_plain_copytree_loses_exec_bit,
+        test_setup_makes_data_copy_executable,
+        test_setup_is_idempotent,
+        test_perm_helper_tolerates_missing_dir,
+    ]
+    failed = 0
+    for test in tests:
+        try:
+            test()
+        except AssertionError as exc:
+            failed += 1
+            print("FAIL %s: %s" % (test.__name__, exc))
+        except Exception as exc:  # noqa: BLE001 - surface anything unexpected
+            failed += 1
+            print("ERROR %s: %r" % (test.__name__, exc))
+        else:
+            print("ok   %s" % test.__name__)
+    if failed:
+        print("\n%d test(s) failed" % failed)
+        return 1
+    print("\nall %d tests passed" % len(tests))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())