Merge pull request 'Fix /data/adb/magisk permissions so Zygisk can initialise' (#284) from MisterWizzard/fix/magisk-data-adb-permissions into main

Reviewed-on: #284

README.md

@@ -166,7 +166,7 @@ chmod 777 -R /mnt/*/*/*/*/Android/obb
 ![](assets/7.png)
 
 ```
-sudo python main.py install microg
+sudo venv/bin/python3 main.py install microg
 ```
 
 ## Hide Status Bar

default.nix

@@ -1,22 +1,4 @@
-with (import <nixpkgs> {});
-
-stdenv.mkDerivation {
-  name = "waydroid_script";
-
-  buildInputs = [
-    (python3.withPackages(ps: with ps; [ tqdm requests inquirerpy ]))
-  ];
-
-  src = ./.;
-
-  postPatch = ''
-    patchShebangs main.py
-  '';
-
-  installPhase = ''
-    mkdir -p $out/libexec
-    cp -r . $out/libexec/waydroid_script
-    mkdir -p $out/bin
-    ln -s $out/libexec/waydroid_script/main.py $out/bin/waydroid_script
-  '';
-}
+let
+  pkgs = import <nixpkgs> {};
+in
+  pkgs.callPackage ./package.nix { }

flake.lock

@@ -0,0 +1,41 @@
+{
+  "nodes": {
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1707650010,
+        "narHash": "sha256-dOhphIA4MGrH4ElNCy/OlwmN24MsnEqFjRR6+RY7jZw=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "809cca784b9f72a5ad4b991e0e7bcf8890f9c3a6",
+        "type": "github"
+      },
+      "original": {
+        "id": "nixpkgs",
+        "type": "indirect"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixpkgs": "nixpkgs",
+        "systems": "systems"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

flake.nix

@@ -0,0 +1,21 @@
+{
+  description = "Waydroid Extras Script";
+  inputs = {
+    systems.url = "github:nix-systems/default";
+  };
+  outputs = { self, nixpkgs, systems }:
+  let
+    inherit (nixpkgs) lib;
+    eachSystem = lib.genAttrs (import systems);
+    mkApp = program: { type = "app"; inherit program; };
+  in {
+    packages = eachSystem (system: rec {
+      waydroid_script = nixpkgs.legacyPackages."${system}".callPackage ./package.nix { };
+      default = waydroid_script;
+    });
+    apps = eachSystem (system: rec {
+      waydroid_script = mkApp "${self.outputs.packages.${system}.waydroid_script}/bin/waydroid_script";
+      default = waydroid_script;
+    });
+  };
+}

main.py

@@ -18,6 +18,7 @@ from stuff.nodataperm import Nodataperm
 from stuff.smartdock import Smartdock
 from stuff.widevine import Widevine
 from stuff.fdroidpriv import FDroidPriv
+from stuff.device_spoof import DeviceSpoof, PROFILES
 import tools.helper as helper
 from tools import container
 from tools import images
@@ -89,6 +90,8 @@ def install_app(args):
         install_list.append(Mitm(args.ca_cert_file))
     if "fdroidpriv" in app:
         install_list.append(FDroidPriv(args.android_version))
+    if "device_spoof" in app:
+        DeviceSpoof(getattr(args, "spoof_profile", "pixel6")).install()
 
     if not container.use_overlayfs():
         copy_dir = "/tmp/waydroid"
@@ -140,6 +143,8 @@ def remove_app(args):
         remove_list.append(Mitm())
     if "fdroidpriv" in app:
         remove_list.append(FDroidPriv(args.android_version))
+    if "device_spoof" in app:
+        DeviceSpoof().uninstall()
     if "nodataperm" in app:
         remove_list.append(Nodataperm(args.android_version))
     if "hidestatusbar" in app:
@@ -210,7 +215,7 @@ def interact():
             Choice(name="Android 13", value="13"),
             Choice(name="Exit", value=None)
         ],
-        default="11",
+        default="13",
     ).execute()
     if not android_version:
         exit()
@@ -229,10 +234,9 @@ def interact():
     if not action:
         exit()
 
-    install_choices = ["gapps", "microg", "libndk", "magisk", "smartdock", "fdroidpriv",]
+    install_choices = ["gapps", "microg", "libndk", "libhoudini", "magisk", "smartdock", "fdroidpriv", "widevine", "device_spoof"]
     hack_choices = []
     if android_version=="11":
-        install_choices.extend(["libhoudini", "widevine"])
         hack_choices.extend(["nodataperm", "hidestatusbar"])
 
     if action == "Install":
@@ -252,6 +256,13 @@ def interact():
                 default="Standard",
             ).execute()
             args.microg_variant = microg_variant
+        if "device_spoof" in apps:
+            spoof_profile = inquirer.select(
+                message="Select device profile to spoof",
+                choices=list(PROFILES.keys()),
+                default="pixel6",
+            ).execute()
+            args.spoof_profile = spoof_profile
         args.app = apps
         install_app(args)
     elif action == "Remove":
@@ -288,7 +299,7 @@ def main():
     parser.add_argument('-a', '--android-version',
                         dest='android_version',
                         help='Specify the Android version',
-                        default="11",
+                        default="13",
                         choices=["11", "13"])
 
     # android command
@@ -297,7 +308,7 @@ def main():
     certified.set_defaults(func=get_certified)
 
     install_choices = ["gapps", "microg", "libndk", "libhoudini",
-                       "magisk", "mitm", "smartdock", "widevine"]
+                       "magisk", "mitm", "smartdock", "widevine", "device_spoof"]
     hack_choices = ["nodataperm", "hidestatusbar"]
     micrg_variants = ["Standard", "NoGoolag", "UNLP", "Minimal", "MinimalIAP"]
     remove_choices = install_choices
@@ -328,6 +339,11 @@ widevine: Add support for widevine DRM L3
                                 dest='ca_cert_file',
                                 help='[for mitm only] The CA certificate file (*.pem) to install',
                                 default=None)
+    install_parser.add_argument('-p', '--spoof-profile',
+                                dest='spoof_profile',
+                                help='[for device_spoof only] Device profile to spoof',
+                                choices=list(PROFILES.keys()),
+                                default="pixel6")
     install_parser.set_defaults(func=install_app)
 
     # remove and its aliases

package.nix

@@ -0,0 +1,32 @@
+{ lib,
+  stdenvNoCC,
+  lzip,
+  python3,
+  makeWrapper }:
+let
+  wrappedPath = lib.makeBinPath [ lzip ];
+in stdenvNoCC.mkDerivation {
+  name = "waydroid_script";
+
+  buildInputs = [
+    (python3.withPackages(ps: with ps; [ tqdm requests inquirerpy ]))
+  ];
+
+  nativeBuildInputs = [
+    makeWrapper
+  ];
+
+  src = ./.;
+
+  postPatch = ''
+    patchShebangs main.py
+  '';
+
+  installPhase = ''
+    mkdir -p $out/libexec
+    cp -r . $out/libexec/waydroid_script
+    mkdir -p $out/bin
+    makeShellWrapper $out/libexec/waydroid_script/main.py $out/bin/waydroid_script \
+      --prefix PATH : "${wrappedPath}"
+  '';
+}

stuff/device_spoof.py

@@ -0,0 +1,71 @@
+import configparser
+from tools.logger import Logger
+
+
+PROFILES = {
+    "pixel6": {
+        "ro.product.brand": "google",
+        "ro.product.manufacturer": "Google",
+        "ro.product.model": "Pixel 6",
+        "ro.product.name": "oriole",
+        "ro.product.device": "oriole",
+        "ro.product.board": "oriole",
+        "ro.build.product": "oriole",
+        "ro.build.fingerprint": "google/oriole/oriole:13/TQ3A.230901.001/10750268:user/release-keys",
+        "ro.build.description": "oriole-user 13 TQ3A.230901.001 10750268 release-keys",
+        "ro.build.version.release": "13",
+        "ro.build.version.sdk": "33",
+        "ro.build.type": "user",
+        "ro.build.tags": "release-keys",
+    },
+    "samsung_s21": {
+        "ro.product.brand": "samsung",
+        "ro.product.manufacturer": "samsung",
+        "ro.product.model": "SM-G991B",
+        "ro.product.name": "o1sxeea",
+        "ro.product.device": "o1s",
+        "ro.product.board": "lahaina",
+        "ro.build.product": "o1s",
+        "ro.build.fingerprint": "samsung/o1sxeea/o1s:13/TP1A.220624.014/G991BXXU5EWCA:user/release-keys",
+        "ro.build.description": "o1sxeea-user 13 TP1A.220624.014 G991BXXU5EWCA release-keys",
+        "ro.build.version.release": "13",
+        "ro.build.version.sdk": "33",
+        "ro.build.type": "user",
+        "ro.build.tags": "release-keys",
+    },
+}
+
+PROP_KEYS = list(next(iter(PROFILES.values())).keys())
+
+
+class DeviceSpoof:
+    id = "device_spoof"
+
+    def __init__(self, profile_name="pixel6") -> None:
+        if profile_name not in PROFILES:
+            raise ValueError(f"Unknown profile '{profile_name}'. Choose from: {list(PROFILES.keys())}")
+        self.profile_name = profile_name
+        self.apply_props = PROFILES[profile_name]
+
+    def _read_cfg(self):
+        cfg = configparser.ConfigParser()
+        cfg.read("/var/lib/waydroid/waydroid.cfg")
+        if not cfg.has_section("properties"):
+            cfg.add_section("properties")
+        return cfg
+
+    def install(self):
+        cfg = self._read_cfg()
+        for key, value in self.apply_props.items():
+            cfg.set("properties", key, value)
+        with open("/var/lib/waydroid/waydroid.cfg", "w") as f:
+            cfg.write(f)
+        Logger.info(f"Device spoofed as '{self.profile_name}'. Restart Waydroid to apply.")
+
+    def uninstall(self):
+        cfg = self._read_cfg()
+        for key in PROP_KEYS:
+            cfg.remove_option("properties", key)
+        with open("/var/lib/waydroid/waydroid.cfg", "w") as f:
+            cfg.write(f)
+        Logger.info("Device spoof properties removed. Restart Waydroid to apply.")

stuff/fdroidpriv.py

@@ -6,6 +6,8 @@ from stuff.general import General
 class FDroidPriv(General):
     id = "fdroid priv"
     dl_links = {"11": ["https://f-droid.org/repo/org.fdroid.fdroid.privileged.ota_2130.zip",
+                       "6242cab56d197d80c598593a46da62e4"],
+               "13": ["https://f-droid.org/repo/org.fdroid.fdroid.privileged.ota_2130.zip",
                        "6242cab56d197d80c598593a46da62e4"]}
     partition = "system"
     dl_file_name = "org.fdroid.fdroid.privileged.ota_2130.zip"

stuff/houdini.py

@@ -10,7 +10,7 @@ class Houdini(General):
     partition = "system"
     dl_links = {
         "11": ["https://github.com/supremegamers/vendor_intel_proprietary_houdini/archive/81f2a51ef539a35aead396ab7fce2adf89f46e88.zip", "fbff756612b4144797fbc99eadcb6653"],
-        # "13": ["https://github.com/supremegamers/vendor_intel_proprietary_houdini/archive/978d8cba061a08837b7e520cd03b635af643ba08.zip", "1e139054c05034648fae58a1810573b4"]
+        "13": ["https://github.com/supremegamers/vendor_intel_proprietary_houdini/archive/2f8f088671182e17e67321e098e8411a3972a628.zip", "37fe0899f1e4da7f9a724cca1c1ab1ea"]
     }
     act_md5 = ...
     dl_link = ...

stuff/magisk.py

@@ -64,7 +64,28 @@ on property:init.svc.zygote=stopped
         Logger.info("Additional setup")
         magisk_absolute_dir = os.path.join(self.copy_dir, self.magisk_dir)
         data_dir = get_data_dir()
-        shutil.copytree(magisk_absolute_dir, os.path.join(data_dir, "adb", "magisk"), dirs_exist_ok=True)
+        data_magisk_dir = os.path.join(data_dir, "adb", "magisk")
+        shutil.copytree(magisk_absolute_dir, data_magisk_dir, dirs_exist_ok=True)
+
+        # General.install() calls set_perm() only over self.files, which are paths
+        # under copy_dir (the overlay). This /data/adb copy is made here, before
+        # that runs, so it keeps the 0644 the binaries inherited from the apk
+        # extraction. A non-executable /data/adb/magisk/magisk64 makes magisk_env()
+        # abort at post-fs-data: root still works from the overlay copy, but Zygisk
+        # silently never initialises (Magisk reports "Zygisk: No" no matter what
+        # the zygisk setting says). Apply the same perms set_path_perm() gives
+        # magisk paths, to this copy too.
+        self.set_data_magisk_perm(data_magisk_dir)
+
+    def set_data_magisk_perm(self, data_magisk_dir):
+        if not os.path.isdir(data_magisk_dir):
+            return
+        os.chmod(data_magisk_dir, 0o755)
+        for root, dirnames, filenames in os.walk(data_magisk_dir):
+            for dirname in dirnames:
+                os.chmod(os.path.join(root, dirname), 0o755)
+            for filename in filenames:
+                os.chmod(os.path.join(root, filename), 0o755)
 
     def copy(self):
         magisk_absolute_dir = os.path.join(self.copy_dir, self.magisk_dir)

stuff/ndk.py

@@ -9,12 +9,12 @@ class Ndk(General):
     partition = "system"
     dl_links = {
         "11": ["https://github.com/supremegamers/vendor_google_proprietary_ndk_translation-prebuilt/archive/9324a8914b649b885dad6f2bfd14a67e5d1520bf.zip", "c9572672d1045594448068079b34c350"],
-        "13": ["https://github.com/supremegamers/vendor_google_proprietary_ndk_translation-prebuilt/archive/a090003c60df53a9eadb2df09bd4fd2fa86ea629.zip", "e6f0d9fc28ebc427b59a3942a9a4ffc0"]
+        "13": ["https://github.com/supremegamers/vendor_google_proprietary_ndk_translation-prebuilt/archive/68734c52556d3d7a6db34c603dd9276915c29f2f.zip", "0b2207c490fcb400aa5c87fcf0d52d38"]
     }
     dl_file_name = "libndktranslation.zip"
     extract_to = "/tmp/libndkunpack"
     apply_props = {
-        "ro.product.cpu.abilist": "x86_64,x86,armeabi-v7a,armeabi,arm64-v8a",
+        "ro.product.cpu.abilist": "x86_64,x86,arm64-v8a,armeabi-v7a,armeabi",
         "ro.product.cpu.abilist32": "x86,armeabi-v7a,armeabi",
         "ro.product.cpu.abilist64": "x86_64,arm64-v8a",
         "ro.dalvik.vm.native.bridge": "libndk_translation.so",
@@ -49,4 +49,4 @@ class Ndk(General):
         Logger.info("Copying libndk library files ...")
         name = re.findall("([a-zA-Z0-9]+)\.zip", self.dl_link)[0]
         shutil.copytree(os.path.join(self.extract_to, "vendor_google_proprietary_ndk_translation-prebuilt-" + name,
-                        "prebuilts"), os.path.join(self.copy_dir, self.partition), dirs_exist_ok=True)
+                        "prebuilts"), os.path.join(self.copy_dir, self.partition), dirs_exist_ok=True)

stuff/nodataperm.py

@@ -10,19 +10,23 @@ from tools import container
 class Nodataperm(General):
     id = "nodataperm"
     dl_links = {
-        "11":
-        {
+        "11": {
+            "x86_64": [
+                "https://github.com/ayasa520/hack_full_data_permission/archive/d4beab7780eb792059d33e77d865579c9ee41546.zip",
+                "b0e3908ffcf5df8ea62f4929aa680f1a"
+            ],
+        },
+        "13": {
             "x86_64": [
                 "https://github.com/ayasa520/hack_full_data_permission/archive/d4beab7780eb792059d33e77d865579c9ee41546.zip",
                 "b0e3908ffcf5df8ea62f4929aa680f1a"
             ],
         },
-        "13": {}
     }
     dl_file_name = "nodataperm.zip"
     extract_to = "/tmp/nodataperm"
-    dl_link = ...
-    act_md5 = ...
+    dl_link = None
+    act_md5 = None
     partition = "system"
     files = [
         "etc/nodataperm.sh",
@@ -36,11 +40,15 @@ class Nodataperm(General):
         super().__init__()
         print("ok")
         arch = self.arch[0]
+        if android_version not in self.dl_links:
+            raise KeyError(f"No download links for Android version '{android_version}'")
+        if arch not in self.dl_links[android_version]:
+            raise KeyError(f"No download links for architecture '{arch}' in Android version '{android_version}'")
         self.dl_link = self.dl_links[android_version][arch][0]
         self.act_md5 = self.dl_links[android_version][arch][1]
 
     def copy(self):
-        name = re.findall("([a-zA-Z0-9]+)\.zip", self.dl_link)[0]
+        name = re.findall(r"([a-zA-Z0-9]+)\.zip", self.dl_link)[0]
         extract_path = os.path.join(
             self.extract_to, f"hack_full_data_permission-{name}")
         if not container.use_overlayfs():

stuff/widevine.py

@@ -13,8 +13,8 @@ class Widevine(General):
         "x86_64": {
             "11": ["https://github.com/supremegamers/vendor_google_proprietary_widevine-prebuilt/archive/48d1076a570837be6cdce8252d5d143363e37cc1.zip",
                    "f587b8859f9071da4bca6cea1b9bed6a"],
-            "13": ["https://github.com/supremegamers/vendor_google_proprietary_widevine-prebuilt/archive/a8524d608431573ef1c9313822d271f78728f9a6.zip",
-                   "5c55df61da5c012b4e43746547ab730f"]
+            "13": ["https://github.com/WayDroid-ATV/vendor_google_proprietary_widevine-prebuilt/archive/679552343d8b2e8d7a19b6df61c7a03963d0c75b.zip",
+                   "80ab79ea85c7b2556baedb371a54e01c"]
         },
         # "armeabi-v7a": ["https://github.com/supremegamers/vendor_google_proprietary_widevine-prebuilt/archive/a1a19361d36311bee042da8cf4ced798d2c76d98.zip", "fed6898b5cfd2a908cb134df97802554"],
         "arm64-v8a": {
@@ -30,7 +30,10 @@ class Widevine(General):
         "etc/init/*widevine.rc",
         "etc/vintf/manifest/*widevine.xml",
         "lib/libwvhidl.so",
+        "lib/libwvaidl.so",
         "lib/mediadrm",
+        "lib64/libwvhidl.so",
+        "lib64/libwvaidl.so",
         "lib64/mediadrm"
     ]
 
@@ -38,9 +41,17 @@ class Widevine(General):
         super().__init__()
         self.dl_link = self.dl_links[self.arch[0]][android_version][0]
         self.act_md5 = self.dl_links[self.arch[0]][android_version][1]
+        self.android_version = android_version
+        self.libdir = "lib64" if self.arch[1] == 64 else "lib"
 
     def copy(self):
         name = re.findall("([a-zA-Z0-9]+)\.zip", self.dl_link)[0]
         Logger.info("Copying widevine library files ...")
         shutil.copytree(os.path.join(self.extract_to, "vendor_google_proprietary_widevine-prebuilt-"+name,
                         "prebuilts"), os.path.join(self.copy_dir, self.partition), dirs_exist_ok=True)
+        if self.android_version == "13":
+            try:
+                os.symlink("libprotobuf-cpp-lite-3.9.1.so",
+                           os.path.join(self.copy_dir, self.partition, self.libdir, "libprotobuf-cpp-lite.so"))
+            except FileExistsError:
+                pass

tests/test_magisk_setup_perms.py

@@ -0,0 +1,179 @@
+#!/usr/bin/env python3
+"""Regression test for Magisk.setup() permissions on the /data/adb/magisk copy.
+
+install() runs copy() -> extra1() -> set_perm(). set_perm() only walks self.files,
+which are paths under copy_dir (the overlay), so the copy that setup() makes into
+<data>/adb/magisk keeps the 0644 the binaries inherit from the apk extraction.
+
+A non-executable /data/adb/magisk/magisk64 makes magisk_env() abort at post-fs-data.
+Root still works (it runs from the overlay copy), but Zygisk never initialises and
+the Magisk app reports "Zygisk: No" with no error explaining why.
+
+Runs as an ordinary user, needs no Waydroid install and no extra dependencies:
+
+    python3 tests/test_magisk_setup_perms.py
+"""
+
+import os
+import shutil
+import stat
+import sys
+import tempfile
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+import stuff.magisk as magisk_module
+from stuff.magisk import Magisk
+
+MAGISK_BINARIES = [
+    "magisk64",
+    "magiskinit",
+    "magiskboot",
+    "magiskpolicy",
+    "busybox",
+    "util_functions.sh",
+]
+
+
+def make_overlay(base):
+    """Mimic the tree copy() leaves behind: binaries written 0644 by shutil.copyfile."""
+    magisk_dir = os.path.join(base, "system", "etc", "init", "magisk")
+    os.makedirs(os.path.join(magisk_dir, "chromeos"), exist_ok=True)
+    for name in MAGISK_BINARIES:
+        path = os.path.join(magisk_dir, name)
+        with open(path, "wb") as f:
+            f.write(b"\x7fELF placeholder")
+        os.chmod(path, 0o644)
+    nested = os.path.join(magisk_dir, "chromeos", "futility")
+    with open(nested, "wb") as f:
+        f.write(b"placeholder")
+    os.chmod(nested, 0o644)
+    return magisk_dir
+
+
+def file_modes(root):
+    modes = {}
+    for dirpath, _dirnames, filenames in os.walk(root):
+        for name in filenames:
+            path = os.path.join(dirpath, name)
+            modes[os.path.relpath(path, root)] = stat.S_IMODE(os.stat(path).st_mode)
+    return modes
+
+
+def test_plain_copytree_loses_exec_bit():
+    """Document the original behaviour: a bare copytree leaves the binaries 0644."""
+    base = tempfile.mkdtemp()
+    try:
+        src = make_overlay(base)
+        dst = os.path.join(base, "data", "adb", "magisk")
+        os.makedirs(os.path.dirname(dst), exist_ok=True)
+        shutil.copytree(src, dst, dirs_exist_ok=True)
+
+        modes = file_modes(dst)
+        assert modes["magisk64"] == 0o644, (
+            "expected the pre-fix behaviour to reproduce, got %o" % modes["magisk64"]
+        )
+    finally:
+        shutil.rmtree(base, ignore_errors=True)
+
+
+def test_setup_makes_data_copy_executable():
+    """setup() must leave every file and dir in <data>/adb/magisk executable."""
+    base = tempfile.mkdtemp()
+    try:
+        make_overlay(base)
+        data_dir = os.path.join(base, "data")
+        os.makedirs(data_dir, exist_ok=True)
+
+        original_get_data_dir = magisk_module.get_data_dir
+        original_info = magisk_module.Logger.info
+        magisk_module.get_data_dir = lambda: data_dir
+        magisk_module.Logger.info = lambda *a, **k: None
+
+        class StubMagisk(Magisk):
+            @property
+            def copy_dir(self):
+                return base
+
+        try:
+            StubMagisk().setup()
+        finally:
+            magisk_module.get_data_dir = original_get_data_dir
+            magisk_module.Logger.info = original_info
+
+        dst = os.path.join(data_dir, "adb", "magisk")
+        modes = file_modes(dst)
+        assert modes, "setup() copied nothing"
+
+        not_executable = {n: oct(m) for n, m in modes.items() if m != 0o755}
+        assert not not_executable, "files left non-0755: %s" % not_executable
+
+        assert stat.S_IMODE(os.stat(dst).st_mode) == 0o755
+        nested = os.path.join(dst, "chromeos")
+        assert stat.S_IMODE(os.stat(nested).st_mode) == 0o755, "nested dir not fixed"
+    finally:
+        shutil.rmtree(base, ignore_errors=True)
+
+
+def test_setup_is_idempotent():
+    base = tempfile.mkdtemp()
+    try:
+        make_overlay(base)
+        data_dir = os.path.join(base, "data")
+        os.makedirs(data_dir, exist_ok=True)
+
+        original_get_data_dir = magisk_module.get_data_dir
+        original_info = magisk_module.Logger.info
+        magisk_module.get_data_dir = lambda: data_dir
+        magisk_module.Logger.info = lambda *a, **k: None
+
+        class StubMagisk(Magisk):
+            @property
+            def copy_dir(self):
+                return base
+
+        try:
+            StubMagisk().setup()
+            StubMagisk().setup()
+        finally:
+            magisk_module.get_data_dir = original_get_data_dir
+            magisk_module.Logger.info = original_info
+
+        dst = os.path.join(data_dir, "adb", "magisk")
+        assert all(m == 0o755 for m in file_modes(dst).values())
+    finally:
+        shutil.rmtree(base, ignore_errors=True)
+
+
+def test_perm_helper_tolerates_missing_dir():
+    Magisk().set_data_magisk_perm(os.path.join(tempfile.gettempdir(), "definitely-not-here"))
+
+
+def main():
+    tests = [
+        test_plain_copytree_loses_exec_bit,
+        test_setup_makes_data_copy_executable,
+        test_setup_is_idempotent,
+        test_perm_helper_tolerates_missing_dir,
+    ]
+    failed = 0
+    for test in tests:
+        try:
+            test()
+        except AssertionError as exc:
+            failed += 1
+            print("FAIL %s: %s" % (test.__name__, exc))
+        except Exception as exc:  # noqa: BLE001 - surface anything unexpected
+            failed += 1
+            print("ERROR %s: %r" % (test.__name__, exc))
+        else:
+            print("ok   %s" % test.__name__)
+    if failed:
+        print("\n%d test(s) failed" % failed)
+        return 1
+    print("\nall %d tests passed" % len(tests))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())