diff --git a/prebuilt/install-recovery.sh b/prebuilt/install-recovery.sh
index 9b43745..f62cf0b 100755
--- a/prebuilt/install-recovery.sh
+++ b/prebuilt/install-recovery.sh
@@ -5,15 +5,13 @@
 # to launch it from init.rc
 
 # Launches SuperSU in daemon mode only on Android 4.3+.
-# Nothing will happen on 4.2.x or older.
+# Nothing will happen on 4.2.x or older, unless SELinux+Enforcing.
 # If you want to force loading the daemon, use "--daemon" instead
 
 /system/xbin/daemonsu --auto-daemon &
 
-# Some apps like to run stuff from this script as well, but the
-# installer will have done "chattr +i" on this file to prevent
-# accidental modification and deletion. In your code, just search 
-# this file for "install-recovery-2.sh", and if present, write
-# there instead.
+# Some apps like to run stuff from this script as well, that will 
+# obviously break root - in your code, just search this file
+# for "install-recovery-2.sh", and if present, write there instead.
 
 /system/etc/install-recovery-2.sh
diff --git a/prebuilt/su b/prebuilt/su
index da77f0a..9415427 100755
--- a/prebuilt/su
+++ b/prebuilt/su
Binary files differ
diff --git a/twrp-functions.cpp b/twrp-functions.cpp
index 4209824..bbd3c4c 100644
--- a/twrp-functions.cpp
+++ b/twrp-functions.cpp
@@ -559,13 +559,21 @@
 	if (!PartitionManager.Mount_By_Path("/system", true))
 		return false;
 
+	string propvalue = System_Property_Get("ro.build.version.sdk");
+	string su_perms = "6755";
+	if (!propvalue.empty()) {
+		int sdk_version = atoi(propvalue.c_str());
+		if (sdk_version >= 18)
+			su_perms = "0755";
+	}
+
 	string file = "/system/bin/su";
 	if (TWFunc::Path_Exists(file)) {
 		if (chown(file.c_str(), 0, 0) != 0) {
 			LOGERR("Failed to chown '%s'\n", file.c_str());
 			return false;
 		}
-		if (tw_chmod(file, "6755") != 0) {
+		if (tw_chmod(file, su_perms) != 0) {
 			LOGERR("Failed to chmod '%s'\n", file.c_str());
 			return false;
 		}
@@ -576,7 +584,7 @@
 			LOGERR("Failed to chown '%s'\n", file.c_str());
 			return false;
 		}
-		if (tw_chmod(file, "6755") != 0) {
+		if (tw_chmod(file, su_perms) != 0) {
 			LOGERR("Failed to chmod '%s'\n", file.c_str());
 			return false;
 		}
@@ -587,7 +595,7 @@
 			LOGERR("Failed to chown '%s'\n", file.c_str());
 			return false;
 		}
-		if (tw_chmod(file, "6755") != 0) {
+		if (tw_chmod(file, "0755") != 0) {
 			LOGERR("Failed to chmod '%s'\n", file.c_str());
 			return false;
 		}
@@ -598,7 +606,7 @@
 			LOGERR("Failed to chown '%s'\n", file.c_str());
 			return false;
 		}
-		if (tw_chmod(file, "6755") != 0) {
+		if (tw_chmod(file, su_perms) != 0) {
 			LOGERR("Failed to chmod '%s'\n", file.c_str());
 			return false;
 		}