Root What is "mksh"?

[CBW0424]

Hey all, I just recently restored a stock sense backup, and I had to flash a stock sense kernal so I did so. But, I began to get messages asking if I should allow mksh superuser permissions (supersu). I denied it, and carried on. But, I keep getting the messages. So can somebody please tell me what "mksh" is exactly?

 

[Dieben]

mksh is the MirBSD Korn Shell LINUX interactive user interface.

You must have a process or app trying to launch a user interface shell for some reason

If you run a logcat and filter it for mksh you may be able to identify what is trying to launch a mksh

 

[CBW0424]

Thanks for the response! Can you tell me exactly how to filter logcat for this? I know how to use the command prompt to open it, just not to filter it.

 

[3vodroid]

im gettting the same message on meanrom. Im also wondering what is causing it. any additional info?

 

[CBW0424]

Sorry for the double post, but does this have something to do with the kernal I flashed, or is it standard android?

 

[3vodroid]

Sorry for the double post, but does this have something to do with the kernal I flashed, or is it standard android?

I myself am not 100% sure, so im trying to find out also. Hopefully someone can fill us in. Im going to GUESS and say no, its not. I only say that because i have not seen this message up until a few days ago.

I should also mention i ONLY see this message when i go into my browser. Not everytime either. Maybe once or twice a day ill see it. And it says something like mksh has been granted.. yadda yadda.

 

[Dieben]

Try using a logcat app like "Logcat Extreme" or "aLogcat". They have search functions at the top of their window.

With Logcat Extreme you can float a "Floating Logcat" window on the screen on top of other apps that you are running.

 

[CBW0424]

Alright, I will give that a go I guess. Thanks!

 

[Dieben]

"set" in a terminal session on my factory stock non-rooted ICS 4.0.4 contains the following lines:

. . .
KSH_VERSION='@(#)MIRBSD KSH R39 2010/08/24'
, . .

and

. . .
MKSH=/system/bin/sh
, , ,

so MKSH appears to be included in standard Android

 

[CBW0424]

Okay! That is good to hear. I hate trying to find where something came from. If it is in stock Android, then that is good. I will try wiping and reinstalling and see if the messages go away. Thanks again.

 

[Dieben]

. . . I hate trying to find where something came from. . .

Talking about trying to find where something came from, one of my favorites was when my company's large billing computer in Atlanta suddenly began to drop off the corporate computer network.

Analyzing the network with the distributed monitoring system that I had built, I discovered that the problem was caused by an improperly configured PC personal computer in one of the company offices in **Detroit**! The problem could as easily have come from any of my company's 32,000 PCs in our 297 offices in 92 countries around the world.

 

[jackgibbs]

I think the latest update to superSU is causing this. I started getting it right after the update, along with jackpal.androidterm, which is the terminal emulator. I have no idea what change could cause this, but I'm fairly certain superSU is the culprit

 

[CBW0424]

Actually, that makes sense, because I wasn't using supersu on the earlier rom... so that must be it!

 

[CBW0424]

Talking about trying to find where something came from, one of my favorites was when my company's large billing computer in Atlanta suddenly began to drop off the corporate computer network.

Analyzing the network with the distributed monitoring system that I had built, I discovered that the problem was caused by an improperly configured PC personal computer in one of the company offices in **Detroit**! The problem could as easily have come from any of my company's 32,000 PCs in our 297 offices in 92 countries around the world.

Sounds like a total nightmare lol. Pretty large company as well!

 

[EarlyMon]

mksh is shorthand for make shell. (wrong, see earlier and follow on post for the truth) It's a standard unix process called when the the Google framework wants to open a network session.

I accepted it.

But chain, maker of SuperSU, says we don't know know enough yet, so reject it and proceed with caution.

It's always been there, just not providing alerts before.

I know and trust what processes I'm running, so I don't care.

If in doubt, reject and stay tuned!

 

[nullspace]

mksh is shorthand for make shell. It's a standard unix process called when the the Google framework wants to open a network session.

I accepted it.

But chain, maker of SuperSU, says we don't know know enough yet, so reject it and proceed with caution.

It's always been there, just not providing alerts before.

I know and trust what processes I'm running, so I don't care.

If in doubt, reject and stay tuned!

Didn't he also say it was only on HTC devices that it was popping up on?

 

[Granite1]

Didn't he also say it was only on HTC devices that it was popping up on?

Yes, and from what I read last time I checked they still didn't know why it was popping up.

I would follow EarlyMons lead and reject it until chains figures it out. Ultimately its your call, and EM obviously likes to "live dangerously".

 

[EarlyMon]

So the record is clear -

http://forum.xda-developers.com/showthread.php?p=33550523

mksh: ip route add 224.0.0.0/4 dev wlan0

As lots of people seem to be around looking for the answer, the current situation on the mksh "ip route add" is as follows:

- mksh is just the name of the default command shell on Android devices, nothing special there

- the "ip route add" command comes from libChange.so in HTC Sense ROMs (thanks to chrisch1974 for finding it), which itself is already running as a system component

- the command itself is not malicious, but there's no clear reason why HTC Sense should run this command. Sense does not need to call "su" to perform this command. Suggestions have been some form of tracking done by HTC (knowing HTC, this would not surprise me at all), or maybe something that has simply been left over during development really does nothing. At this time, nobody but HTC knows for sure. I do not personally currently own any recent affected HTC devices, as such it is not something I will further deeply investigate

- the reason it shows up in SuperSU v0.97 and does not show up in older versions is because v0.97 no longer automatically grants root to the shell and system processes. This command is run as system. Normally, only code provided by the OEM, or from an app that has already previously been granted root access can run as system. However, I have been informed of exploits that can allow a malicious program to gain system (not root) user access, and as such the system user is no longer safe, and must be specifically granted permission

- my advise would be to set it to deny (without asking again next time) until we know more

the IP toast notification is only on sense roms, running virus check on zips and phone shows nothing. this is actually not a new problem. Im pretty sure it has something to do with what i posted above.

mksh is a command interpreter intended for both interactive and shell script use. Its command language is a superset of the sh(C) shell language and largely compatible to the original Korn shell.

heres more info on mksh apperantly its an at&t thing..... mksh is the MirBSD Korn Shell, largely similar to the original AT&T ksh, pdksh

 

[CBW0424]

Yeah, usually it comes up when launching an app that requires a network connection, but when I deny it, everything works normally. Just strange.

 

[EarlyMon]

Strange but understandable.

In the world of unix permissions and apps calling apps, a called app (process) can inherit its parent's permissions or it can be pre-specified to have certain permissions regardless.

I expect that if we dig under the hood there will be little mystery here.

 

[CBW0424]

I agree. And I have one more thing to add. A few minutes ago, I turned my wifi on and got the message right after the 3 bar signal symbol appeared. To test if it was a coincidence, I repeated this a few times and got the message over and over. Only happened when I switched from 3G to wifi, not the other way around.

 

[mirabilos]

mksh is shorthand for make shell.

No, it’s not. It’s for “MirBSD Korn Shell”, a Unix shell largely similar to the original AT&T Korn Shell.

called when the the Google framework wants to open a network session.

Not just that; it’s also called from “adb shell” on rooted devices and terminal emulators even on locked-down devices. It’s the equivalent of COMMAND.COM or CMD.EXE on Microsoft

 

[EarlyMon]

Welcome to the forums, I've never been happier to be corrected!

Information is power, thank you so much for clearing that up and for your contributions!

:adore:

 

[doctor90250]

I just had it pop up on rooted LG Motion, I denied it. Earlier today, I did open "terminal emulator" in TOMORROW TOOLBOX, just because I've never opened it before, but I closed it without entering anything. I was curious also .
Stock ROM