Norton Password Manager is claiming my S22 is rooted

[fbutler]

Hi,

The Norton Password Manager App is saying that my S22 is rooted, however when I check for root using apps such as Root Checker, Phone Info, and Device Info 360, they all say that the device is not rooted. The only app that suggests that it might be rooted is RootBeer Sample, which was recommended by someone on the Norton Community forums. That app shows root against a "SE Linux Flag is Enabled" item.

How can I verify for certain if the device is actually rooted, and if it is then, if it is,  what steps do I need to take to un-root it?

The S22 was bought directly from Samsung so is using the Samsung Version of Android. Let me know.

Fergal

[Pugs1957]

I know root checker is accurate and you certainly wouldn't have been supplied such a modified device from Samsung. Another sign of a rooted phone is non working banking apps.
It could be a fault with Norton, however, you may want to check you have given full permissions to the app as it may interpreting lack of permissions as the device being rooted.

[fbutler]

Yeah, I'm trying to escalate the issue with Norton, however that is proving to be a slow process. 

All other apps appear to be working fine including my banking app.

The Norton Error message says "Contact your carrier or retailer's service to have the device restored" Obviously I'm reluctant to go down this route as I don't believe the phone is actually rooted.

The output form using the "Advanced Verify Root" option in the paid version of Root Checker shows the detailed report below:

Overall Status: Root access is not installed on this device

Feedback Mode: Install Root
Issue: Not installed superuser app and su binary, and unable to access root user account

Feedback: Locate a guide for root installation on a SM-S901B device

Stage 1 - Superuser App: Not Installed
NOT installed: SuperSU by Chainfire, Superuser by ChainsDD, or Superuser by Koush

Stage 2 - Superuser Binary Files: Not Installed
Standard System Location
Command: ls -l /system/bin/su
Result: ls: /system/bin/su: No such file or directory
Analysis: File /system/bin/su does not exist.

Standard System Location
Command: ls -l /system/xbin/su
Result: ls: /system/xbin/su: No such file or directory
Analysis: File /system/xbin/su does not exist.

Standard System-less Location
Command: ls -l /su/bin/su
Result: ls: /su/bin/su: No such file or directory
Analysis: File /su/bin/su does not exist.

Alternative Location
Command: ls -l /sbin/su
Result: ls: /sbin/su: No such file or directory
Analysis: File /sbin/su does not exist.

Alternative Location
Command: ls -l /system/xbin/sudo
Result: ls: /system/xbin/sudo: No such file or directory
Analysis: File /system/xbin/sudo does not exist.

Alternative Location
Command: ls -l /magisk/.core/bin/su
Result: ls: /magisk/.core/bin/su: No such file or directory
Analysis: File /magisk/.core/bin/su does not exist.

Alternative System Environment Location
Command: ls -l /product/bin/su
Result: ls: /product/bin/su: No such file or directory
Analysis: File /product/bin/su does not exist.

Alternative System Environment Location
Command: ls -l /apex/com.android.runtime/bin/su
Result: ls: /apex/com.android.runtime/bin/su: No such file or directory
Analysis: File /apex/com.android.runtime/bin/su does not exist.

Alternative System Environment Location
Command: ls -l /apex/com.android.art/bin/su
Result: ls: /apex/com.android.art/bin/su: No such file or directory
Analysis: File /apex/com.android.art/bin/su does not exist.

Alternative System Environment Location
Command: ls -l /system_ext/bin/su
Result: ls: /system_ext/bin/su: No such file or directory
Analysis: File /system_ext/bin/su does not exist.

Alternative System Environment Location
Command: ls -l /odm/bin/su
Result: ls: /odm/bin/su: No such file or directory
Analysis: File /odm/bin/su does not exist.

Alternative System Environment Location
Command: ls -l /vendor/bin/su
Result: ls: /vendor/bin/su: No such file or directory
Analysis: File /vendor/bin/su does not exist.

Alternative System Environment Location
Command: ls -l /vendor/xbin/su
Result: ls: /vendor/xbin/su: No such file or directory
Analysis: File /vendor/xbin/su does not exist.

Stage 3 - Root User Account: Error
Error: java.io.IOException: Cannot run program "su": error=2, No such file or directory

Optional - ADB Shell User
Status: Checked /default.prop for ro.secure setting: No world/other read access to /default.prop

Additional - Google SafetyNet Status
SafetyNet Status: True
Google evaluates hardware and software against Android specifications

Additional - System Environment PATH
System Environment PATH: /product/bin /apex/com.android.runtime/bin /apex/com.android.art/bin /system_ext/bin /system/bin /system/xbin /odm/bin /vendor/bin /vendor/xbin

Results provided for your SM-S901B - Android 13 device by Root Checker Pro version 6.5.3 from joeykrim in Google Play - http://goo.gl/NcnHn

[Glenntech]

Yes as @Pugs1957 says
The fault is almost certainly the Norton Software
Check the things as has been mentioned
But the phone already has built in security software anyway.
This could also be affecting the Norton software

[Pugs1957]

I believe I know the issue. Nowadays manufacturers have been using SELinux to protect the kernel. Norton sees this as a security issue whereas disabling to allow the app to load would be reducing security.

Beer Root gave the wrong result so I checked them out. Seems thus was an old project on github which was not widely tested and was abandoned some time ago.
Norton can easily resolve this but it does seem odd that it's a password manager causing grief.

[fbutler]

Thanks for your input @Pugs1957. That's the same conclusion that I came to regarding the root beer sample app. When I saw the result from that app I did a bit of digging and saw that the app has "best efforts support" and numerous reports of false positives for the "SE Linux Flag" check in the App's issues log on github: Issues · scottyab/rootbeer (github.com)

In particular in issue #183 agnostic-apollo commented in April: “@scottyab You may wanna check kdrag0n/safetynet-fix#166 (comment) and remove the check altogether.” and provides a link to https://github.com/kdrag0n/safetynet-fix/pull/166#issuecomment-1509789489 containing details of why they think the SE Linux Flag check is flawed.

I've provided Norton with this information and I was told on Sunday that the issue has been escalated to their engineers, however I haven't heard anything back since then.

Unfortunately I don't have the necessary skills in mobile OSes to be able to further investigate this issue.  Are there any other checks that I should perform to confirm  whether or not the device is rooted to enable me to further escalate the issue with Norton?

[Pugs1957]

I think you've provided adequate information to confirm your phone is not rooted, I get the same results as you so this has to be common place. Hopefully Norton will get their act together.