new file mode 100644
@@ -0,0 +1,51 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Alex Kiernan <alex.kiernan@gmail.com>
+Date: Sat, 7 Nov 2026 16:00:25 +0000
+Subject: [PATCH] adbd: keep root on Linux only while the build is debuggable
+
+`adb root` is refused unless __android_log_is_debuggable(), but the root
+state it writes to /run/adbd.root is honoured on every restart without
+asking again. A unit that stops being debuggable while that file
+survives keeps a root adbd. Drop privileges whenever the build is not
+debuggable, whatever the file says; drop_privileges() then rewrites it
+as #NOROOT#.
+
+Without LIBLOG_DEBUGGABLE_PROP_FILES the build is always debuggable on
+Linux, so nothing changes.
+
+Upstream-Status: Pending
+
+AI-Generated: Claude Opus 5.5 (Claude Code)
+Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
+---
+ packages/modules/adb/daemon/main.cpp | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/packages/modules/adb/daemon/main.cpp b/packages/modules/adb/daemon/main.cpp
+index d309e235b947..9da530d18d27 100644
+--- a/packages/modules/adb/daemon/main.cpp
++++ b/packages/modules/adb/daemon/main.cpp
+@@ -40,9 +40,10 @@
+ #include <android-base/stringprintf.h>
+ #include <android-base/strings.h>
+
++#include <log/log_properties.h>
++
+ #if defined(__ANDROID__)
+ #include <libminijail.h>
+-#include <log/log_properties.h>
+ #include <scoped_minijail.h>
+
+ #include <private/android_filesystem_config.h>
+@@ -200,6 +201,11 @@ static void drop_privileges(int server_port) {
+
+ #if !defined(__ANDROID__)
+ static bool should_drop_privileges() {
++ // The root state file outlives the debuggable state that allowed it to be
++ // written, so only honour it while the build is still debuggable.
++ if (!__android_log_is_debuggable()) {
++ return true;
++ }
+ int f = unix_open(kAdbRootStatePath, O_RDONLY | O_CLOEXEC | O_NOFOLLOW);
+ if (f < 0) {
+ return true;
@@ -68,6 +68,7 @@ SRC_URI = "https://deb.debian.org/debian/pool/main/a/android-platform-tools/andr
file://0021-liblog-optionally-read-ro.debuggable-from-build.prop.patch \
file://0022-adbd-optionally-require-authorization-unless-the-bui.patch \
file://0023-libadbd_auth-optionally-take-the-trusted-key-paths-a.patch \
+ file://0024-adbd-keep-root-on-Linux-only-while-the-build-is-debu.patch \
"
SRC_URI[orig.md5sum] = "352376965cdef7bd7505d8fefdd43d50"
adbd on Linux restarts as root whenever /run/adbd.root says so, without asking whether the build is still debuggable. With debuggable-prop that can change while the file survives, so honour it only while __android_log_is_debuggable() is true. AI-Generated: Claude Opus 5.5 (Claude Code) Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com> --- ...oot-on-Linux-only-while-the-build-is-debu.patch | 51 ++++++++++++++++++++++ .../android-tools/android-tools_35.0.2.bb | 1 + 2 files changed, 52 insertions(+)