diff --git a/packages/bionic-host/boringssl-host.subpackage.sh b/packages/bionic-host/boringssl-host.subpackage.sh
new file mode 100644
index 000000000000000..1749e882ec6a00c
--- /dev/null
+++ b/packages/bionic-host/boringssl-host.subpackage.sh
@@ -0,0 +1,8 @@
+# dependency of:
+# /system/bin/ping6 (iputils-host)
+# /system/bin/md5sum (toybox-host)
+TERMUX_SUBPKG_DESCRIPTION="AOSP-based boringssl for termux-docker"
+TERMUX_SUBPKG_INCLUDE="
+opt/bionic-host/lib/libcrypto.so
+opt/bionic-host/lib64/libcrypto.so
+"
diff --git a/packages/bionic-host/build.sh b/packages/bionic-host/build.sh
index d46b9c7d8271124..acbcce26e1c1cf8 100644
--- a/packages/bionic-host/build.sh
+++ b/packages/bionic-host/build.sh
@@ -1,12 +1,11 @@
-TERMUX_PKG_HOMEPAGE=https://android.googlesource.com/platform/bionic/
-TERMUX_PKG_DESCRIPTION="bionic libc, libm, libdl and dynamic linker for ubuntu host"
+TERMUX_PKG_HOMEPAGE=https://source.android.com/
+TERMUX_PKG_DESCRIPTION="bionic libc, libm, libdl, libz, liblzma, libicuuc, dynamic linker and debugger for ubuntu host and termux-docker"
 TERMUX_PKG_LICENSE="BSD 3-Clause"
 TERMUX_PKG_MAINTAINER="@termux"
-TERMUX_PKG_VERSION="8.0.0-r51"
-TERMUX_PKG_REVISION=5
-TERMUX_PKG_SHA256=6b42a86fc2ec58f86862a8f09a5465af0758ce24f2ca8c3cabb3bb6a81d96525
+TERMUX_PKG_VERSION="9.0.0-r76"
 TERMUX_PKG_AUTO_UPDATE=false
 TERMUX_PKG_BUILD_IN_SRC=true
+TERMUX_PKG_HOSTBUILD=true
 TERMUX_PKG_SKIP_SRC_EXTRACT=true
 # Should be handled by AOSP build system so I am disable it here.
 TERMUX_PKG_UNDEF_SYMBOLS_FILES="all"
@@ -76,12 +75,30 @@ termux_step_get_source() {
 		-u https://android.googlesource.com/platform/manifest \
 		-b main -m "${TERMUX_PKG_BUILDER_DIR}/default.xml" <<< 'n'
 	"${TERMUX_PKG_CACHEDIR}"/repo sync -c -j32
+}
 
-	sed -i '1s|.*|\#!'"${TERMUX_PKG_SRCDIR}"'/prebuilts/python/linux-x86/2.7.5/bin/python2|' "${TERMUX_PKG_SRCDIR}/bionic/libc/fs_config_generator.py"
-	sed -i '1s|.*|\#!'"${TERMUX_PKG_SRCDIR}"'/prebuilts/python/linux-x86/2.7.5/bin/python2|' "${TERMUX_PKG_SRCDIR}/external/clang/clang-version-inc.py"
-	sed -i '/selinux/d' "${TERMUX_PKG_SRCDIR}/system/core/debuggerd/Android.bp"
-	sed -i '/selinux/d' "${TERMUX_PKG_SRCDIR}/system/core/debuggerd/crash_dump.cpp"
-	sed -i '/selinux/d' "${TERMUX_PKG_SRCDIR}/system/core/debuggerd/debuggerd.cpp"
+termux_step_host_build() {
+	# Correctly-functioning Python 2 seems to be a mandatory build dependency,
+	# but using the prebuilt Python 2 from AOSP seemed to result in this error,
+	# in AOSP 9.0.0 but not in AOSP 8.0.0 or 8.1.0:
+	# /home/builder/.termux-build/bionic-host/src/prebuilts/python/linux-x86/2.7.5/bin/python2:
+	# can't decompress data; zlib not available
+	# which only went away when I recompiled Python 2.
+	PYTHON2_WORKDIR="${TERMUX_PKG_TMPDIR}/python2"
+	# recreate prefix and re-add prefix bin folder to $PATH so that if the redundant code doing that in
+	# termux_step_get_source() is ever removed in the future, this block does not break
+	export PATH="${TERMUX_PKG_SRCDIR}/prefix/usr/bin:${PATH}"
+	mkdir -p "${PYTHON2_WORKDIR}" "${TERMUX_PKG_SRCDIR}/prefix"
+	termux_download https://www.python.org/ftp/python/2.7.18/Python-2.7.18.tar.xz \
+		"${TERMUX_PKG_CACHEDIR}/python2.tar.xz" \
+		b62c0e7937551d0cc02b8fd5cb0f544f9405bafc9a54d3808ed4594812edef43
+	tar xf "${TERMUX_PKG_CACHEDIR}/python2.tar.xz" --strip-components=1 -C "${PYTHON2_WORKDIR}"
+	pushd "${PYTHON2_WORKDIR}"
+	./configure --prefix="${TERMUX_PKG_SRCDIR}/prefix/usr"
+	make install
+	popd
+	python2 -m ensurepip
+	pip2 install --upgrade setuptools pip
 }
 
 termux_step_configure() {
@@ -94,12 +111,13 @@ termux_step_make() {
 		cd ${TERMUX_PKG_SRCDIR}
 		source build/envsetup.sh;
 		lunch aosp_${_ARCH}-eng;
-		make JAVA_NOT_REQUIRED=true linker libc libm libdl libicuuc debuggerd crash_dump
+		export ALLOW_MISSING_DEPENDENCIES=true
+		make linker libc libm libdl libicuuc debuggerd crash_dump
+		make toybox sh mkshrc ping ping6 tracepath tracepath6 traceroute6 arping
 	"
 }
 
 termux_step_make_install() {
-	mkdir -p "${TERMUX_PREFIX}/opt/bionic-host/usr/icu"
-	cp "${TERMUX_PKG_SRCDIR}/external/icu/icu4c/source/stubdata/icudt58l.dat" "${TERMUX_PREFIX}/opt/bionic-host/usr/icu/"
+	mkdir -p "${TERMUX_PREFIX}/opt/bionic-host/"
 	cp -r "${TERMUX_PKG_SRCDIR}"/out/target/product/generic*/system/* "${TERMUX_PREFIX}/opt/bionic-host/"
 }
diff --git a/packages/bionic-host/default.xml b/packages/bionic-host/default.xml
index f4aff2514b448d5..6b72e1505d0d1ac 100644
--- a/packages/bionic-host/default.xml
+++ b/packages/bionic-host/default.xml
@@ -1,10 +1,11 @@
 <?xml version="1.0" encoding="UTF-8"?>
+<!--This XML file is based on this one: https://android.googlesource.com/platform/manifest/+/refs/heads/android-9.0.0_r61/default.xml -->
 <manifest>
 
   <remote name="aosp" fetch=".." review="https://android-review.googlesource.com/" />
-  <default revision="refs/tags/android-8.0.0_r51" remote="aosp" sync-j="4" />
+  <default revision="refs/tags/android-security-9.0.0_r76" remote="aosp" sync-j="4" />
 
-  <project path="build/make" name="platform/build" groups="pdk" >
+  <project path="build/make" name="platform/build" groups="pdk">
     <copyfile src="core/root.mk" dest="Makefile" />
     <linkfile src="CleanSpec.mk" dest="build/CleanSpec.mk" />
     <linkfile src="buildspec.mk.default" dest="build/buildspec.mk.default" />
@@ -15,15 +16,18 @@
   </project>
   <project path="build/blueprint" name="platform/build/blueprint" groups="pdk,tradefed" />
   <project path="build/kati" name="platform/build/kati" groups="pdk,tradefed" />
-  <project path="build/soong" name="platform/build/soong" groups="pdk,tradefed" >
+  <project path="build/soong" name="platform/build/soong" groups="pdk,tradefed">
     <linkfile src="root.bp" dest="Android.bp" />
     <linkfile src="bootstrap.bash" dest="bootstrap.bash" />
   </project>
+  <project path="art" name="platform/art" groups="pdk" />
   <project path="bionic" name="platform/bionic" groups="pdk" />
+  <project path="external/boringssl" name="platform/external/boringssl" groups="pdk" />
   <project path="external/clang" name="platform/external/clang" groups="pdk" />
   <project path="external/compiler-rt" name="platform/external/compiler-rt" groups="pdk" />
   <project path="external/elfutils" name="platform/external/elfutils" groups="pdk" />
   <project path="external/icu" name="platform/external/icu" groups="pdk" />
+  <project path="external/iputils" name="platform/external/iputils" groups="pdk" />
   <project path="external/jemalloc" name="platform/external/jemalloc" groups="pdk" />
   <project path="external/libcxx" name="platform/external/libcxx" groups="pdk" />
   <project path="external/libcxxabi" name="platform/external/libcxxabi" groups="pdk" />
@@ -31,21 +35,25 @@
   <project path="external/libunwind_llvm" name="platform/external/libunwind_llvm" groups="pdk" />
   <project path="external/llvm" name="platform/external/llvm" groups="pdk" />
   <project path="external/lzma" name="platform/external/lzma" groups="pdk" />
+  <project path="external/mksh" name="platform/external/mksh" groups="pdk" />
   <project path="external/safe-iop" name="platform/external/safe-iop" groups="pdk" />
+  <project path="external/toybox" name="platform/external/toybox" groups="pdk" />
+  <project path="external/valgrind" name="platform/external/valgrind" groups="pdk" />
+  <project path="external/vixl" name="platform/external/vixl" groups="pdk" />
   <project path="external/zlib" name="platform/external/zlib" groups="pdk" />
-  <project path="kernel/tests" name="kernel/tests" />
+  <project path="libnativehelper" name="platform/libnativehelper" groups="pdk" />
   <project path="prebuilts/build-tools" name="platform/prebuilts/build-tools" groups="pdk" clone-depth="1" />
+  <project path="prebuilts/clang-tools" name="platform/prebuilts/clang-tools" groups="pdk" clone-depth="1" />
   <project path="prebuilts/clang/host/linux-x86" name="platform/prebuilts/clang/host/linux-x86" groups="pdk" clone-depth="1" />
   <project path="prebuilts/gcc/linux-x86/aarch64/aarch64-linux-android-4.9" name="platform/prebuilts/gcc/linux-x86/aarch64/aarch64-linux-android-4.9" groups="pdk,linux,arm" clone-depth="1" />
-  <project path="prebuilts/gcc/linux-x86/arm/arm-eabi-4.8" name="platform/prebuilts/gcc/linux-x86/arm/arm-eabi-4.8" groups="pdk,linux,arm" clone-depth="1" />
   <project path="prebuilts/gcc/linux-x86/arm/arm-linux-androideabi-4.9" name="platform/prebuilts/gcc/linux-x86/arm/arm-linux-androideabi-4.9" groups="pdk,linux,arm" clone-depth="1" />
   <project path="prebuilts/gcc/linux-x86/host/x86_64-linux-glibc2.15-4.8" name="platform/prebuilts/gcc/linux-x86/host/x86_64-linux-glibc2.15-4.8" groups="pdk,linux" clone-depth="1" />
   <project path="prebuilts/gcc/linux-x86/x86/x86_64-linux-android-4.9" name="platform/prebuilts/gcc/linux-x86/x86/x86_64-linux-android-4.9" groups="pdk,linux,x86" clone-depth="1" />
   <project path="prebuilts/go/linux-x86" name="platform/prebuilts/go/linux-x86" groups="linux,pdk,tradefed" clone-depth="1" />
   <project path="prebuilts/misc" name="platform/prebuilts/misc" groups="pdk" clone-depth="1" />
   <project path="prebuilts/ndk" name="platform/prebuilts/ndk" groups="pdk" clone-depth="1" />
-  <project path="prebuilts/python/linux-x86/2.7.5" name="platform/prebuilts/python/linux-x86/2.7.5" groups="linux,pdk,pdk-cw-fs,pdk-fs" clone-depth="1" />
   <project path="prebuilts/sdk" name="platform/prebuilts/sdk" groups="pdk" clone-depth="1" />
   <project path="prebuilts/tools" name="platform/prebuilts/tools" groups="pdk,tools" clone-depth="1" />
   <project path="system/core" name="platform/system/core" groups="pdk" />
+  <project path="system/timezone" name="platform/system/timezone" groups="pdk" />
 </manifest>
diff --git a/packages/bionic-host/disable-jdk.patch b/packages/bionic-host/disable-jdk.patch
deleted file mode 100644
index c450c3b0ffd269a..000000000000000
--- a/packages/bionic-host/disable-jdk.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-+++ a/build/make/core/config.mk
-@@ -654,23 +654,6 @@
- 
- COLUMN:= column
- 
--# We may not have the right JAVA_HOME/PATH set up yet when this is run from envsetup.sh.
--ifneq ($(CALLED_FROM_SETUP),true)
--HOST_JDK_TOOLS_JAR:= $(shell $(BUILD_SYSTEM)/find-jdk-tools-jar.sh)
--
--ifneq ($(HOST_JDK_TOOLS_JAR),)
--ifeq ($(wildcard $(HOST_JDK_TOOLS_JAR)),)
--$(error Error: could not find jdk tools.jar at $(HOST_JDK_TOOLS_JAR), please check if your JDK was installed correctly)
--endif
--endif
--
--# Is the host JDK 64-bit version?
--HOST_JDK_IS_64BIT_VERSION :=
--ifneq ($(filter 64-Bit, $(shell java -version 2>&1)),)
--HOST_JDK_IS_64BIT_VERSION := true
--endif
--endif  # CALLED_FROM_SETUP not true
--
- # It's called md5 on Mac OS and md5sum on Linux
- ifeq ($(HOST_OS),darwin)
- MD5SUM:=md5 -q
diff --git a/packages/bionic-host/iputils-host.subpackage.sh b/packages/bionic-host/iputils-host.subpackage.sh
new file mode 100644
index 000000000000000..bccee5c105c47aa
--- /dev/null
+++ b/packages/bionic-host/iputils-host.subpackage.sh
@@ -0,0 +1,13 @@
+# $PREFIX/bin/ping from termux-tools is a script that depends on /system/bin/ping
+# which is implemented in standard Android ROMs by the code that this package is built from.
+# The same applies to $PREFIX/bin/ping6.
+TERMUX_SUBPKG_DESCRIPTION="AOSP-based iputils for termux-docker"
+TERMUX_SUBPKG_DEPENDS="boringssl-host"
+TERMUX_SUBPKG_INCLUDE="
+opt/bionic-host/bin/arping
+opt/bionic-host/bin/ping
+opt/bionic-host/bin/ping6
+opt/bionic-host/bin/tracepath
+opt/bionic-host/bin/tracepath6
+opt/bionic-host/bin/traceroute6
+"
diff --git a/packages/bionic-host/mksh-host.subpackage.sh b/packages/bionic-host/mksh-host.subpackage.sh
new file mode 100644
index 000000000000000..37e22d0dabc8399
--- /dev/null
+++ b/packages/bionic-host/mksh-host.subpackage.sh
@@ -0,0 +1,7 @@
+# it is a little bit different from main/mksh because of
+# the binary name, the version, the build settings and patches including prefix, and the mkshrc
+TERMUX_SUBPKG_DESCRIPTION="AOSP-based mksh for termux-docker"
+TERMUX_SUBPKG_INCLUDE="
+opt/bionic-host/bin/sh
+opt/bionic-host/etc/mkshrc
+"
diff --git a/packages/bionic-host/no-undefined-deps.patch b/packages/bionic-host/no-undefined-deps.patch
deleted file mode 100644
index f3e3e485d47ef83..000000000000000
--- a/packages/bionic-host/no-undefined-deps.patch
+++ /dev/null
@@ -1,71 +0,0 @@
-+++ a/build/blueprint/context.go
-@@ -1209,7 +1209,7 @@
- 			return nil
- 		}
- 		return []error{&BlueprintError{
--			Err: fmt.Errorf("%q depends on undefined module %q",
-+			Err: fmt.Errorf("%q 1depends on undefined module %q",
- 				module.Name(), depName),
- 			Pos: module.pos,
- 		}}
-@@ -1286,15 +1286,8 @@
- 
- 	possibleDeps := c.modulesFromName(depName)
- 	if possibleDeps == nil {
--		if c.allowMissingDependencies {
--			module.missingDeps = append(module.missingDeps, depName)
--			return nil
--		}
--		return []error{&BlueprintError{
--			Err: fmt.Errorf("%q depends on undefined module %q",
--				module.Name(), depName),
--			Pos: module.pos,
--		}}
-+		module.missingDeps = append(module.missingDeps, depName)
-+		return nil
- 	}
- 
- 	// We can't just append variant.Variant to module.dependencyVariants.variantName and
-@@ -1996,19 +1989,6 @@
- 			return true
- 		}
- 
--		if module.missingDeps != nil && !mctx.handledMissingDeps {
--			var errs []error
--			for _, depName := range module.missingDeps {
--				errs = append(errs, &BlueprintError{
--					Err: fmt.Errorf("%q depends on undefined module %q",
--						module.Name(), depName),
--					Pos: module.pos,
--				})
--			}
--			errsCh <- errs
--			return true
--		}
--
- 		depsCh <- mctx.ninjaFileDeps
- 
- 		newErrs := c.processLocalBuildActions(&module.actionDefs,
-+++ a/build/soong/android/paths.go	2023-11-08 07:59:01.069137952 +020
-@@ -360,11 +360,6 @@
- 		return ret
- 	}
- 
--	if exists, _, err := ctx.Fs().Exists(ret.String()); err != nil {
--		reportPathError(ctx, "%s: %s", ret, err.Error())
--	} else if !exists {
--		reportPathError(ctx, "source path %s does not exist", ret)
--	}
- 	return ret
- }
- 
-+++ a/build/blueprint/module_ctx.go
-@@ -488,7 +488,7 @@
- }
- 
- func (m *moduleContext) GetMissingDependencies() []string {
--	m.handledMissingDeps = true
-+	m.handledMissingDeps = false
- 	return m.module.missingDeps
- }
- 
diff --git a/packages/bionic-host/toybox-enable-su-disable-selinux.patch b/packages/bionic-host/toybox-enable-su-disable-selinux.patch
new file mode 100644
index 000000000000000..febc04d3cbc7aed
--- /dev/null
+++ b/packages/bionic-host/toybox-enable-su-disable-selinux.patch
@@ -0,0 +1,227 @@
+Enables su, disables use of su by non-root users,
+and disables selinux, getenforce, load_policy, restorecon, runcon, setenforce and chcon.
+
+Plus, these commits cherry-picked and slightly rewritten, mainly noted here to serve as documentation
+of landley's strong implication that this su implementation is probably intended for compatibility with Android,
+making it the closest possible thing to an "official" implementation of su on Android there is.
+https://github.com/landley/toybox/commit/0bb61e3aefc32940d8578eb174bf6e39dca17c35
+https://github.com/landley/toybox/commit/20eb4585a140a4bcd7901d4892a3222ff9f0d122
+
+--- a/external/toybox/Android.mk
++++ b/external/toybox/Android.mk
+@@ -65,13 +65,8 @@ common_SRC_FILES := \
+     lib/portability.c \
+     lib/xwrap.c \
+     main.c \
+-    toys/android/getenforce.c \
+-    toys/android/load_policy.c \
+     toys/android/log.c \
+-    toys/android/restorecon.c \
+-    toys/android/runcon.c \
+     toys/android/sendevent.c \
+-    toys/android/setenforce.c \
+     toys/android/setprop.c \
+     toys/android/start.c \
+     toys/lsb/dmesg.c \
+@@ -83,6 +78,7 @@ common_SRC_FILES := \
+     toys/lsb/mount.c \
+     toys/lsb/pidof.c \
+     toys/lsb/seq.c \
++    toys/lsb/su.c \
+     toys/lsb/sync.c \
+     toys/lsb/umount.c \
+     toys/net/ifconfig.c \
+@@ -95,7 +91,6 @@ common_SRC_FILES := \
+     toys/other/base64.c \
+     toys/other/blkid.c \
+     toys/other/blockdev.c \
+-    toys/other/chcon.c \
+     toys/other/chroot.c \
+     toys/other/chrt.c \
+     toys/other/clear.c \
+@@ -234,7 +229,7 @@ common_CFLAGS := \
+     -ffunction-sections -fdata-sections \
+     -fno-asynchronous-unwind-tables \
+ 
+-toybox_libraries := liblog libselinux libcutils libcrypto libz
++toybox_libraries := liblog libcutils libcrypto libz
+ 
+ common_CFLAGS += -DTOYBOX_VENDOR=\"-android\"
+ 
+@@ -251,7 +246,6 @@ ALL_TOOLS := \
+     blockdev \
+     cal \
+     cat \
+-    chcon \
+     chgrp \
+     chmod \
+     chown \
+@@ -282,7 +276,6 @@ ALL_TOOLS := \
+     flock \
+     fmt \
+     free \
+-    getenforce \
+     groups \
+     gunzip \
+     gzip \
+@@ -297,7 +290,6 @@ ALL_TOOLS := \
+     iorenice \
+     kill \
+     killall \
+-    load_policy \
+     ln \
+     log \
+     logname \
+@@ -338,15 +330,12 @@ ALL_TOOLS := \
+     readlink \
+     realpath \
+     renice \
+-    restorecon \
+     rm \
+     rmdir \
+     rmmod \
+-    runcon \
+     sed \
+     sendevent \
+     seq \
+-    setenforce \
+     setprop \
+     setsid \
+     sha1sum \
+@@ -361,6 +350,7 @@ ALL_TOOLS := \
+     stat \
+     stop \
+     strings \
++    su \
+     stty \
+     swapoff \
+     swapon \
+--- a/external/toybox/generated/config.h
++++ b/external/toybox/generated/config.h
+@@ -36,8 +36,8 @@
+ #define USE_TOYBOX_ANDROID_SCHEDPOLICY(...) __VA_ARGS__
+ #define CFG_TOYBOX_PEDANTIC_ARGS 0
+ #define USE_TOYBOX_PEDANTIC_ARGS(...)
+-#define CFG_TOYBOX_SELINUX 1
+-#define USE_TOYBOX_SELINUX(...) __VA_ARGS__
++#define CFG_TOYBOX_SELINUX 0
++#define USE_TOYBOX_SELINUX(...)
+ #define CFG_TOYBOX_SHADOW 0
+ #define USE_TOYBOX_SHADOW(...)
+ #define CFG_TOYBOX_SMACK 0
+@@ -84,8 +84,8 @@
+ #define USE_CD(...)
+ #define CFG_CHATTR 1
+ #define USE_CHATTR(...) __VA_ARGS__
+-#define CFG_CHCON 1
+-#define USE_CHCON(...) __VA_ARGS__
++#define CFG_CHCON 0
++#define USE_CHCON(...)
+ #define CFG_CHGRP 1
+ #define USE_CHGRP(...) __VA_ARGS__
+ #define CFG_CHMOD 1
+@@ -206,8 +206,8 @@
+ #define USE_FTPGET(...)
+ #define CFG_FTPPUT 0
+ #define USE_FTPPUT(...)
+-#define CFG_GETENFORCE 1
+-#define USE_GETENFORCE(...) __VA_ARGS__
++#define CFG_GETENFORCE 0
++#define USE_GETENFORCE(...)
+ #define CFG_GETFATTR 1
+ #define USE_GETFATTR(...) __VA_ARGS__
+ #define CFG_GETPROP 0
+@@ -288,8 +288,8 @@
+ #define USE_LINK(...)
+ #define CFG_LN 1
+ #define USE_LN(...) __VA_ARGS__
+-#define CFG_LOAD_POLICY 1
+-#define USE_LOAD_POLICY(...) __VA_ARGS__
++#define CFG_LOAD_POLICY 0
++#define USE_LOAD_POLICY(...)
+ #define CFG_LOGGER 0
+ #define USE_LOGGER(...)
+ #define CFG_LOGIN 0
+@@ -440,8 +440,8 @@
+ #define USE_RENICE(...) __VA_ARGS__
+ #define CFG_RESET 0
+ #define USE_RESET(...)
+-#define CFG_RESTORECON 1
+-#define USE_RESTORECON(...) __VA_ARGS__
++#define CFG_RESTORECON 0
++#define USE_RESTORECON(...)
+ #define CFG_REV 1
+ #define USE_REV(...) __VA_ARGS__
+ #define CFG_RFKILL 1
+@@ -454,16 +454,16 @@
+ #define USE_RM(...) __VA_ARGS__
+ #define CFG_ROUTE 0
+ #define USE_ROUTE(...)
+-#define CFG_RUNCON 1
+-#define USE_RUNCON(...) __VA_ARGS__
++#define CFG_RUNCON 0
++#define USE_RUNCON(...)
+ #define CFG_SED 1
+ #define USE_SED(...) __VA_ARGS__
+ #define CFG_SENDEVENT 1
+ #define USE_SENDEVENT(...) __VA_ARGS__
+ #define CFG_SEQ 1
+ #define USE_SEQ(...) __VA_ARGS__
+-#define CFG_SETENFORCE 1
+-#define USE_SETENFORCE(...) __VA_ARGS__
++#define CFG_SETENFORCE 0
++#define USE_SETENFORCE(...)
+ #define CFG_SETFATTR 1
+ #define USE_SETFATTR(...) __VA_ARGS__
+ #define CFG_SETPROP 1
+@@ -510,8 +510,8 @@
+ #define USE_STRINGS(...) __VA_ARGS__
+ #define CFG_STTY 1
+ #define USE_STTY(...) __VA_ARGS__
+-#define CFG_SU 0
+-#define USE_SU(...)
++#define CFG_SU 1
++#define USE_SU(...) __VA_ARGS__
+ #define CFG_SULOGIN 0
+ #define USE_SULOGIN(...)
+ #define CFG_SWAPOFF 1
+--- a/external/toybox/toys/lsb/su.c
++++ b/external/toybox/toys/lsb/su.c
+@@ -41,9 +41,8 @@ static char *snapshot_env(char *name)
+ 
+ void su_main()
+ {
+-  char *name, *passhash = 0, **argu, **argv;
++  char *name, **argu, **argv;
+   struct passwd *up;
+-  struct spwd *shp;
+ 
+   if (*toys.optargs && !strcmp("-", *toys.optargs)) {
+     toys.optflags |= FLAG_l;
+@@ -53,13 +52,22 @@ void su_main()
+   if (*toys.optargs) name = *(toys.optargs++);
+   else name = "root";
+ 
+-  if (!(shp = getspnam(name))) perror_exit("no '%s'", name);
+   if (getuid()) {
+-    if (*shp->sp_pwdp != '$') goto deny;
++    // /etc/shadow does not exist on android, so this su implementation can
++    // only be successfully called by root (getuid() returning 0)
++    /*
++    if (!(shadow = get_userline("/etc/shadow", name)))
++      perror_exit("no '%s'", name);
++    if (*shadow[1] != '$') goto deny;
+     if (read_password(toybuf, sizeof(toybuf), "Password: ")) goto deny;
+-    passhash = crypt(toybuf, shp->sp_pwdp);
++    passhash = crypt(toybuf, shadow[1]);
++    if (!passhash || strcmp(passhash, shadow[1])) name = 0;
+     memset(toybuf, 0, sizeof(toybuf));
+-    if (!passhash || strcmp(passhash, shp->sp_pwdp)) goto deny;
++    memset(shadow[1], 0, strlen(shadow[1]));
++    if (passhash) memset(passhash, 0, strlen(passhash));
++    if (!name) goto deny;
++    */
++    goto deny;
+   }
+ 
+   up = xgetpwnam(name);
diff --git a/packages/bionic-host/toybox-host.subpackage.sh b/packages/bionic-host/toybox-host.subpackage.sh
new file mode 100644
index 000000000000000..a9445dc248a9bae
--- /dev/null
+++ b/packages/bionic-host/toybox-host.subpackage.sh
@@ -0,0 +1,151 @@
+TERMUX_SUBPKG_DESCRIPTION="AOSP-based toybox for termux-docker"
+TERMUX_SUBPKG_DEPENDS="boringssl-host"
+TERMUX_SUBPKG_INCLUDE="
+opt/bionic-host/bin/toybox
+opt/bionic-host/bin/acpi
+opt/bionic-host/bin/base64
+opt/bionic-host/bin/basename
+opt/bionic-host/bin/blockdev
+opt/bionic-host/bin/cal
+opt/bionic-host/bin/cat
+opt/bionic-host/bin/chgrp
+opt/bionic-host/bin/chmod
+opt/bionic-host/bin/chown
+opt/bionic-host/bin/chroot
+opt/bionic-host/bin/chrt
+opt/bionic-host/bin/cksum
+opt/bionic-host/bin/clear
+opt/bionic-host/bin/cmp
+opt/bionic-host/bin/comm
+opt/bionic-host/bin/cp
+opt/bionic-host/bin/cpio
+opt/bionic-host/bin/cut
+opt/bionic-host/bin/date
+opt/bionic-host/bin/df
+opt/bionic-host/bin/diff
+opt/bionic-host/bin/dirname
+opt/bionic-host/bin/dmesg
+opt/bionic-host/bin/dos2unix
+opt/bionic-host/bin/du
+opt/bionic-host/bin/echo
+opt/bionic-host/bin/env
+opt/bionic-host/bin/expand
+opt/bionic-host/bin/expr
+opt/bionic-host/bin/fallocate
+opt/bionic-host/bin/false
+opt/bionic-host/bin/file
+opt/bionic-host/bin/find
+opt/bionic-host/bin/flock
+opt/bionic-host/bin/fmt
+opt/bionic-host/bin/free
+opt/bionic-host/bin/groups
+opt/bionic-host/bin/gunzip
+opt/bionic-host/bin/gzip
+opt/bionic-host/bin/head
+opt/bionic-host/bin/hostname
+opt/bionic-host/bin/hwclock
+opt/bionic-host/bin/id
+opt/bionic-host/bin/ifconfig
+opt/bionic-host/bin/inotifyd
+opt/bionic-host/bin/insmod
+opt/bionic-host/bin/ionice
+opt/bionic-host/bin/iorenice
+opt/bionic-host/bin/kill
+opt/bionic-host/bin/killall
+opt/bionic-host/bin/ln
+opt/bionic-host/bin/log
+opt/bionic-host/bin/logname
+opt/bionic-host/bin/losetup
+opt/bionic-host/bin/ls
+opt/bionic-host/bin/lsmod
+opt/bionic-host/bin/lsof
+opt/bionic-host/bin/lspci
+opt/bionic-host/bin/lsusb
+opt/bionic-host/bin/md5sum
+opt/bionic-host/bin/microcom
+opt/bionic-host/bin/mkdir
+opt/bionic-host/bin/mkfifo
+opt/bionic-host/bin/mknod
+opt/bionic-host/bin/mkswap
+opt/bionic-host/bin/mktemp
+opt/bionic-host/bin/modinfo
+opt/bionic-host/bin/modprobe
+opt/bionic-host/bin/more
+opt/bionic-host/bin/mount
+opt/bionic-host/bin/mountpoint
+opt/bionic-host/bin/mv
+opt/bionic-host/bin/netstat
+opt/bionic-host/bin/nice
+opt/bionic-host/bin/nl
+opt/bionic-host/bin/nohup
+opt/bionic-host/bin/od
+opt/bionic-host/bin/paste
+opt/bionic-host/bin/patch
+opt/bionic-host/bin/pgrep
+opt/bionic-host/bin/pidof
+opt/bionic-host/bin/pkill
+opt/bionic-host/bin/pmap
+opt/bionic-host/bin/printenv
+opt/bionic-host/bin/printf
+opt/bionic-host/bin/ps
+opt/bionic-host/bin/pwd
+opt/bionic-host/bin/readlink
+opt/bionic-host/bin/realpath
+opt/bionic-host/bin/renice
+opt/bionic-host/bin/rm
+opt/bionic-host/bin/rmdir
+opt/bionic-host/bin/rmmod
+opt/bionic-host/bin/sed
+opt/bionic-host/bin/sendevent
+opt/bionic-host/bin/seq
+opt/bionic-host/bin/setprop
+opt/bionic-host/bin/setsid
+opt/bionic-host/bin/sha1sum
+opt/bionic-host/bin/sha224sum
+opt/bionic-host/bin/sha256sum
+opt/bionic-host/bin/sha384sum
+opt/bionic-host/bin/sha512sum
+opt/bionic-host/bin/sleep
+opt/bionic-host/bin/sort
+opt/bionic-host/bin/split
+opt/bionic-host/bin/start
+opt/bionic-host/bin/stat
+opt/bionic-host/bin/stop
+opt/bionic-host/bin/strings
+opt/bionic-host/bin/stty
+opt/bionic-host/bin/su
+opt/bionic-host/bin/swapoff
+opt/bionic-host/bin/swapon
+opt/bionic-host/bin/sync
+opt/bionic-host/bin/sysctl
+opt/bionic-host/bin/tac
+opt/bionic-host/bin/tail
+opt/bionic-host/bin/tar
+opt/bionic-host/bin/taskset
+opt/bionic-host/bin/tee
+opt/bionic-host/bin/time
+opt/bionic-host/bin/timeout
+opt/bionic-host/bin/top
+opt/bionic-host/bin/touch
+opt/bionic-host/bin/tr
+opt/bionic-host/bin/true
+opt/bionic-host/bin/truncate
+opt/bionic-host/bin/tty
+opt/bionic-host/bin/ulimit
+opt/bionic-host/bin/umount
+opt/bionic-host/bin/uname
+opt/bionic-host/bin/uniq
+opt/bionic-host/bin/unix2dos
+opt/bionic-host/bin/uptime
+opt/bionic-host/bin/usleep
+opt/bionic-host/bin/uudecode
+opt/bionic-host/bin/uuencode
+opt/bionic-host/bin/vmstat
+opt/bionic-host/bin/wc
+opt/bionic-host/bin/which
+opt/bionic-host/bin/whoami
+opt/bionic-host/bin/xargs
+opt/bionic-host/bin/xxd
+opt/bionic-host/bin/yes
+opt/bionic-host/bin/zcat
+"