What causes "Current su does not allow Binder communication." in MuntashirAkon/AppManager?

Use a su implementation that grants Binder access to its root context (Magisk is the reference; update it to latest).

MuntashirAkon/AppManager · critical · IOException

Current su does not allow Binder communication.

Error message

Current su does not allow Binder communication.

What it means

RootServiceMain runs as root (uid 0) and needs Binder IPC to talk back to the app. Some su implementations run root shells in isolated contexts where seapp/domain policy blocks Binder; if Process.myUid()==0 and allowBinderCommunication() (a selinux context check) fails, the constructor throws IOException('Current su does not allow Binder communication.') because the root service could never communicate with the client process.

Source

Thrown at server/src/main/java/io/github/muntashirakon/AppManager/server/RootServiceMain.java:154

    }

    private final int uid;
    private final boolean isDaemon;

    @Override
    public Object[] call() {
        Object[] objs = new Object[2];
        objs[0] = uid;
        objs[1] = isDaemon;
        return objs;
    }

    @SuppressLint("DiscouragedPrivateApi")
    public RootServiceMain(String[] args) throws Exception {
        super(null);

        if (Process.myUid() == 0 && !allowBinderCommunication()) {
            throw new IOException("Current su does not allow Binder communication.");
        }

        ComponentName name = ComponentName.unflattenFromString(args[0]);
        uid = Integer.parseInt(args[1]);
        String action = args[2];
        boolean stop = false;

        switch (action) {
            case CMDLINE_STOP_SERVICE:
                stop = true;
                // fallthrough
            case CMDLINE_START_DAEMON:
                isDaemon = true;
                break;
            case CMDLINE_START_SERVICE:
                isDaemon = false;
                break;
            default:

View on GitHub (pinned to 0152f468fc)

Solutions

Use a su implementation that grants Binder access to its root context (Magisk is the reference; update it to latest).
Check the resulting SELinux context with `su -c id -Z`; if it lacks binder perms, adjust the sepolicy/domain or use `su -mm` / mount-namespace options that permit binder.
On custom ROMs, add/patch a sepolicy rule allowing the su domain's binder uses, or launch the service through a supported mechanism (e.g. AppManager's own root request path).
Verify with a simple `su -c 'service list'` whether Binder works at all under the device's root before assuming an app bug.

Example fix

// before (device shell)
su -c 'sh /path/to/start_server.sh'
// after (force a magisk context that allows binder / mount master namespace)
su -mm -c 'sh /path/to/start_server.sh'

Defensive patterns

Strategy: validation

Validate before calling

// on device, before launching the root service:
String ctx = runSuCommand("id -Z");
if (ctx == null || !ctx.contains("magisk")) { // expected binder-capable domain
    throw new UnsupportedOperationException("su context " + ctx + " does not allow Binder; use Magisk su");
}

Try / catch

try {
    new RootServiceMain(args);
} catch (IOException e) {
    if (e.getMessage() != null && e.getMessage().contains("Binder")) {
        // fall back to non-Binder mode (adb/shell API surface) or show setup instructions
    }
}

Prevention

Standardize on Magisk (latest) as the root provider; test `su -c 'service list'` during device provisioning.
Check `id -Z` under su before starting Binder-dependent services.
Provide a non-Binder fallback path for rooted devices with hardened sepolicy.
Document required SELinux domains in setup docs for custom-ROM users.

When it happens

Trigger: Starting the root service under a su that runs it in an SELinux domain/context without binder access — e.g. Magisk su with restrictive context, KernelSU, or vendor su variants — when Process.myUid()==0 and allowBinderCommunication() returns false; also when args[0] (component) is launched from an unsuitable context.

Common situations: Devices with unusual SELinux policies or non-Magisk su implementations; running the server from a shell context (u:r:magisk:s0 variants lacking binder) instead of the expected domain; custom ROMs with hardened sepolicy; KernelSU or partially rooted setups.

Understand the failure class

Background: "unsupported platform" / "not supported on this platform" errors: what they mean and how to fix them — this error's family across 47 libraries.

Related errors

AI-assisted analysis of MuntashirAkon/AppManager@0152f468fc (2026-09-12). Data as JSON: /api/errors/4c60b726411d39c6. Report an issue: GitHub.