How does rooting work? Or, how do I root my device without a rooter?

Rooting instructions for Android devices that I have seen are typically of the following form:


Download Gingerbreak.apk
Run Gingerbreak, click “root device”
Observe that Superuser.apk has been magically installed, possibly along with busybox and other things, and enjoy your rooty goodness.


What I am wanting to know is this: how does the rooting actually happen? What does Gingerbreak do?

I understand the end result of rooting:


su is present and working
Superuser.apk is installed and controls access to su
Various utilities are present, provided by BusyBox (optional?)


I also think I understand the basic idea of how Gingerbreak gets started — it exploits some local privilege escalation vulnerability and uses its new-found powers to deploy Superuser and whatever else is necessary.

So, unless I am wrong in some of the understanding I laid out above, the core of thing I want to know is what the root installer does to deploy and activate Superuser. It seems that just putting Superuser.apk in the right place wouldn't be enough — how does it get allowed root access? How does it get hooked up to moderate that access for other applications?

What does Gingerbreak do post-exploit to enable and secure root access?
What the APK and exploit do (usually) is as follows:


The APK puts the right files in the right place to run the exploit
The APK runs the exploit
The exploit attempts to attain root access
If it succeeds, the exploit remounts /system as read-write and runs the installer script
The installer script attempts to install the su binary and superuser APK, and reboots


As an example, this page details how the rageagainstthecage exploit attempts to gain elevated privileges.