Wifi hotspot - App not allowed to read or update stored Wifi ap config (uid = 0)

[Megakawa]

Dear developer, i can't use this feature although i have areadly used app systemizer for magisk to install your app under /system/priv-app

[tigran123]

I have the same problem on rooted Samsung Galaxy Tab S4 with Android 10, model SM-T830, WiFi.

[tigran123]

UPDATE: I studied a little bit the way VPNHotspot works and figured out how to setup WiFi Hotspot on WiFi only model S4, as well as on Nexus 10 (though dnsmasq part on Nexus is a bit different). Anyway, here are the working files for the rooted S4, running Android 10, tested in Termux 0.119.0-beta3

1. Create a /data/vendor/wifi/hostapd/hostapd.conf:

interface=swlan0
driver=nl80211
ssid=TIGRANLIB
country_code=GB
ieee80211d=1
ieee80211ac=0
hw_mode=g
channel=6
ieee80211n=1

ignore_broadcast_ssid=0
wowlan_triggers=any

wpa=2
wpa_key_mgmt=WPA-PSK
rsn_pairwise=CCMP
wpa_passphrase=mentovka123

2. Create a /data/local/tmp/dnsmasq.conf:

interface=swlan0
bind-interfaces
no-resolv
no-hosts
dhcp-authoritative
dhcp-range=192.168.50.50,192.168.50.150,12h
dhcp-option=3,192.168.50.1
dhcp-option=6,8.8.8.8,8.8.4.4
log-dhcp
log-queries
log-facility=/data/local/tmp/dnsmasq.log

3. Script for starting AP -- start_ap.sh -- run as root (i.e. after tsu in Termux):

#!/system/bin/sh

set -x

# kill stock Wi-Fi client side
svc wifi disable
pkill -f wpa_supplicant
setprop ctl.stop wifi_supplicant
pkill -f p2p_supplicant

# reset physical interface
ip link set wlan0 down
ip addr flush dev wlan0
ip link set wlan0 up

unset LD_PRELOAD
/vendor/bin/hw/hostapd -B /data/vendor/wifi/hostapd/hostapd.conf

# use swlan0 as AP interface
ip link set swlan0 up
ip addr flush dev swlan0
ip addr add 192.168.50.1/24 dev swlan0

# ensure kernel routes are used for all UIDs
ip rule add pref 31999 from all lookup main

# just in case open the ports for dnsmasq (not needed in most cases)
#iptables -I INPUT  1 -i swlan0 -p udp --dport 67 -j ACCEPT
#iptables -I INPUT  1 -i swlan0 -p udp --dport 68 -j ACCEPT
#iptables -I OUTPUT 1 -o swlan0 -p udp --sport 67 -j ACCEPT
#iptables -I OUTPUT 1 -o swlan0 -p udp --dport 68 -j ACCEPT

rm -f /data/local/tmp/dnsmasq.pid /data/local/tmp/dnsmasq.log
dnsmasq --conf-file=/data/local/tmp/dnsmasq.conf --pid-file=/data/local/tmp/dnsmasq.pid

4. Scipt to stop AP -- stop_ap.sh -- again, run as root:

#!/system/bin/sh
pkill dnsmasq
pkill -f "/vendor/bin/hw/hostapd"
ip addr flush dev swlan0
ip link set swlan0 down
ip addr flush dev wlan0
ip link set wlan0 down
ip rule del pref 31999

# tidy firewall (only first four rules if present)
#iptables -D INPUT  -i "$IF_AP" -p udp --dport 67 -j ACCEPT 2>/dev/null || true
#iptables -D INPUT  -i "$IF_AP" -p udp --dport 68 -j ACCEPT 2>/dev/null || true
#iptables -D OUTPUT -o "$IF_AP" -p udp --sport 67 -j ACCEPT 2>/dev/null || true
#iptables -D OUTPUT -o "$IF_AP" -p udp --dport 68 -j ACCEPT 2>/dev/null || true

svc wifi enable

Also, you need to create a small Magisk module to enable the ioctls used by hostapd and dnsmasq. Let's call it enable_hotspot. So, just create a directory /data/adb/modules/enable_hotspot with these two files:

module.prop

id=enable_hotspot
name=Enable Hotspot
version=1.0
versionCode=1
author=Tigran Aivazian
description=Enable hostapd in Enforcing by granting a few ioctls

sepolicy.rule

allowxperm magisk magisk udp_socket ioctl 0x8927
allowxperm magisk magisk udp_socket ioctl 0x8914
allowxperm magisk magisk udp_socket ioctl 0x89f1
allowxperm magisk magisk udp_socket ioctl 0x8955

[tigran123]

I forgot to mention that the whole point of WiFi hotspot functionality for me is to access the library on the micro sd card of S4 tablet from Kobo eInk devices which do not support micro sd. My library is 500GB in size, so it won't fit in the local storage on Kobo and so having WiFi hotspot on S4 is very useful for browsing the books on it.

In particular, this means that I do not care about Internet, etc. I did not even test if the NAT/forwarding (e.g. to Ethernet through USB adapter) would work with the above setup -- probably not, but it is not hard to add, I just don't need this functionality.