I managed to get persistent root access on this old BusyBox-based e‑reader.
Here is the procedure I used.
Interrupt U‑Boot and boot directly into a shell as PID 1:
setenv bootargs root=/dev/mmcblk0p4 rootdelay=2 rw init=/bin/sh noinitrd console=ttySAC2,115200 hwconfig=0x0110032233414237 platform=ep3
movi read kernel c0008000
bootm c0008000
Verify that the system is running and that I already have a root shell:
uname -a
id
Make a backup of /etc/passwd:
text
cp /etc/passwd /etc/passwd.bak
ls -l /etc/passwd /etc/passwd.bak
Remove the password for the root account by replacing root:x: with root:::
sed -i 's/^root:x:/root::/' /etc/passwd
head -5 /etc/passwd
# Expect:
# root::0:0:root:/:/bin/sh
Enable setuid root on BusyBox so that su works later from a normal user:
ls -l /bin/busybox
chmod u+s /bin/busybox
ls -l /bin/busybox
# Expect:
# -rwsr-xr-x 1 root root 408068 Apr 11 2012 /bin/busybox
After reboot, I can log in as the regular user over SSH and then simply run:
su
id
# uid=0(root) gid=0(root) …
This gives me a persistent, passwordless root login (via su) on the device, while still keeping a backup of the original /etc/passwd as /etc/passwd.bak in case I need to restore it.
Code:
setenv bootargs root=/dev/mmcblk0p4 rootdelay=2 rw init=/bin/sh noinitrd console=ttySAC2,115200 hwconfig=0x0110032233414237 platform=ep3
movi read kernel c0008000
bootm c0008000
BusyBox v1.16.1 (2010-10-11 18:29:44 EEST) built-in shell (ash)
Enter 'help' for a list of built-in commands.
/bin/sh: can't access tty; job control turned off
# uname -a
Linux (none) 2.6.29.6 #1 PREEMPT Fri Dec 9 16:05:22 EET 2011 armv6l GNU/Linux
# id
uid=0(root) gid=0(root)
# cp /etc/passwd /etc/passwd.bak
# ls -l /etc/passwd /etc/passwd.bak
-rw-r--r-- 1 root root 155 Apr 11 2012 /etc/passwd
-rw-r--r-- 1 root root 155 Jan 8 15:51 /etc/passwd.bak
# sed -i 's/^root:x:/root::/' /etc/passwd
# cat /etc/passwd | head -5
root::0:0:root:/:/bin/sh
bin:*:1:1:bin:/bin:
daemon:*:2:2:daemon:/sbin:
nobody:*:99:99:Nobody:/:
reader:*:101:101:reader:/:
# ls -l /bin/busybox
-rwxr-xr-x 1 root root 408068 Apr 11 2012 /bin/busybox
# chmod u+s /bin/busybox
# ls -l /bin/busybox
-rwsr-xr-x 1 root root 408068 Apr 11 2012 /bin/busybox
#