sunfish-admin/AXP-Resurection
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

009: Polish bacon fixes, OTA host scripts, and migration docs.

Browse Source 
Restore disable_configstore, EuiccDisabler and thermal CDEV guards, branding
and rebuild/sync helpers; document device roles, laptop migration, and Gitea.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
sunfish-adminandCursor committed 2026-10-16 21:06:45 +02:00
1 parent 3f941e8451
commit 2d145c2878
3193 files changed
+21264 -371
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

docs/009-axp-graphene-remaining.md
+38 -63
View File
@@ -1,79 +1,54 @@
# 009 — Remaining path to AXP / Graphene-class ship (post clean-429)
# 009 — Remaining path after Magisk closure
**Stale as an execution order.** Boot, vendor SPL, lock-scope, release-keys,
and `hardened_malloc` moved on 2026-10-08. Start from
`docs/009-handoff-20261008.md`.
**Updated 2026-10-10.** Older “post clean-429 / leave test-keys” execution
order is obsolete. Resume: [`009-handoff-20261008.md`](009-handoff-20261008.md).
Closure: [`009-closure-parity-20261009.md`](009-closure-parity-20261009.md).
Authoritative requirements: `specs/009-axp-los23-port/spec.md` + constitution.
KernelSU stays out of Magisk ship boots (optional recycle only).
Non-normative roadmap after LAB **BOOT_OK** on Stage1+combo4+FORTIFY+Magisk+
**CVE clean-offset 429** (denylist `CVE-2022-49980`), kernel `#47`
(`20261001T180955Z-axp-stage1-combo4-cve-clean`). Authoritative requirements
remain `specs/009-axp-los23-port/spec.md` + constitution.
Goal (owner): **almost all** applicable AXP.OS / Graphene-class behaviour on
LOS 23.2 sunfish Magisk track — not a blind dump, not bootloader lock.
**2026-10-07 next-bacon correction:** `misc/0021` is already present in the
LOS kernel base. Stage1 must omit it and use `patch --forward`; otherwise GNU
patch auto-reverses it and shrinks `KSYM_NAME_LEN` 192→128 under Clang CFI.
The first corrected candidate retains 192 and applies only the
`CVE-2022-49980` lock-scope companion as its new kernel delta.
## Already landed (kernel / Magisk core)
## Already landed (LAB closure, 2026-10-09)
| Layer | Status |
|-------|--------|
| Stage1 Graphene/AH | Ship |
| Combo4 + Clang FORTIFY | Ship |
| Magisk preroot EXTENDROM-class | Ship |
| CVE clean-offset 429 | Ship (LAB OK) |
| `CVE-2022-49980` | Original one-liner denylisted; corrected lock-scope candidate next |
| High-offset CVE (~73) | Quarantine — triage started |
| Stage1 + combo4 + Clang FORTIFY | Ship |
| CVE clean-offset + hi batches 1–3 | Ship (`CVE-2022-49980` one-liner denylisted; lock-scope companion applied) |
| Magisk 30.7 EXTENDROM preroot | Ship |
| `user` + project `release-keys` | Ship |
| AVB flags 0 (unlocked) | Ship |
| Deblob waves 1–4 (selective; not AXP `Deblob.sh`) | Ship |
| `hardened_malloc` (64-bit; SF/camera exclusions) | Ship |
| Call-rec / FLAG_SECURE DO toggles (`008`) | Ship |
| Private DNS / connectivity (no axp.os endpoints) | Ship |
| Swissquote usable in Island | **PASS** |
| Bootanimation | Lineage (no AXP asset in PRO payload) |
Recover/bisect baseline: `20260929T123401Z-axp-stage1-combo4` (`#32`).
## Kernel remaining (toward “AXP CVE / Graphene depth”)
1. **High-offset quarantine** — KEEP batches 1–3 **shipped** (`151944Z`).
nf_tables leftovers still skipped. Next kernel depth: **US-S5-1** defconfig
(Yama + `SLAB_FREELIST_RANDOM`), not more bulk CVE.
2. **`CVE-2022-49980` proper port** — keep UAF fix without recursive
`udc_lock` using the reviewed lock-scope companion. Boot and USB gadget
smoke are still required; the original one-liner remains denylisted.
3. Failed Stage1 probes (allocsize/ro/slab) — low priority vs high-offset.
4. Graphene modern techniques / `hardened_malloc` — backlog (`docs/hardening-backlog.md`);
evaluate after CVE depth is stable.
## Userspace / product remaining (AXP surface)
From `docs/009-capability-matrix.md` / Gate G (still open or partial):
## Still open / next
| Item | Notes |
|------|--------|
| Release keys + AVB (unlocked) | US-S2/S3 — leave test-keys |
| Private DNS / connectivity check | Patches exist; keep AXP-class, no axp.os endpoints |
| Call-rec / FLAG_SECURE | `008` — selectable unlock |
| Bundled apps (Aurora, Droidify, gallery, …) | Packaging |
| Disable-app UX on A16 | Restore classic Disable |
| Hosts / DNS privacy helpers | Magisk module vs ROM-native TBD |
| WebView | LOS default (Aosmium exception) |
| Banking / Island | Deferred |
| Bootloader lock | Wont |
| KernelSU swap | Optional later; do not mix Magisk ship boots |
| **Upstream LOS 23.2 rebase + first project OTA zip** | [`009-upstream-rebase-ota.md`](009-upstream-rebase-ota.md) — bacon scripts ready; sync automation not |
| **Yuh in Island on LAB** | Open — Play A16/sunfish filter + install-source; see [`009-yuh-golden-lab-hypothesis.md`](009-yuh-golden-lab-hypothesis.md) |
| Wallapop / PairIP-class apps | Root cause 2026-10-10: Yama `ptrace_scope=2` (US-S5-1 + `apply_009_yama_ptrace.py`). PairIP's anti-debug ptrace is denied, so it dies with SIGSEGV. GOLDEN kernel has no Yama. Next OTA leaves `CONFIG_SECURITY_YAMA` unset |
| FR-019 APK sideload cadence | Stub: [`009-sideload-system-updates.md`](009-sideload-system-updates.md) |
| Release-key custody polish | Keys under `/srv/rom/secrets/`; offline copy confirm |
| Physical-SIM call gate | Owner before more radio deblob |
| Leftover high-offset CVE / failed Stage1 probes | Optional, small batches |
| KernelSU / SusFS parallel retry | Keep `007-*`; bridge [`007-parallel-on-009.md`](007-parallel-on-009.md) — never mix into Magisk ship bacon |
| Bootloader lock | Wont (AXP/LOS unlocked norm) |
## Suggested execution order (default if owner has no preference)
## Suggested order (default)
1. Finish high-offset **relevance filter** → small apply batches (≤10) with
strict applicator + LAB boot each batch.
2. Wire **release keys** bacon of current ship pack; keep Magisk/preroot OK.
3. Land remaining **Settings/UX** AXP clones (DNS, connectivity, disable-app)
if not already on LAB zip.
4. Optional: 49980 lock-scope port; Graphene userspace / hardened_malloc spikes.
1. Owner supplies new LOS sunfish build pin → follow `009-upstream-rebase-ota.md`.
2. Rebacon with `scripts/009-bacon-axp-stage1-combo4-cve-hi-releasekeys.sh` (+ wave4/malloc wrappers if still required).
3. LAB sideload smoke: Magisk, Island, Swissquote, radio.
4. Yuh / Play compatibility experiments (LAB only).
5. Fill FR-019 sideload commands when packaging is frozen.
## Do-not
- Reflash full-503 / old kh-cve zips.
- Bulk-apply high-offset without manual review.
- Reflash full-503 / old `kh-cve` / FORTIFY-broken zips.
- Bulk-apply high-offset CVE without review.
- Mix KernelSU into Magisk ship boots.
- Treat “almost AXP/Graphene” as requiring locked bootloader.
- Run AXP `Deblob.sh` defaults.
- Treat “AXP/Graphene-class” as requiring locked bootloader.