sunfish-admin/AXP-Resurection
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

009: Polish bacon fixes, OTA host scripts, and migration docs.

Browse Source 
Restore disable_configstore, EuiccDisabler and thermal CDEV guards, branding
and rebuild/sync helpers; document device roles, laptop migration, and Gitea.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
sunfish-adminandCursor committed 2026-10-16 21:06:45 +02:00
1 parent 3f941e8451
commit 2d145c2878
3193 files changed
+21264 -371
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

vendor/sunfish-a16/patches/009-kernel-hardening/uss5-1-README.md
Vendored
+12 -9
View File
@@ -1,4 +1,4 @@
# US-S5-1 — Yama + SLAB freelist random (defconfig)
# US-S5-1 — SLAB freelist random (defconfig); Yama off like GOLDEN
**Track**: AXP Resurection Pro Magisk, unlocked sunfish.
**On top of**: Stage1 + combo4 + FORTIFY + CVE clean-429 + hi-batch1–3.
@@ -12,9 +12,17 @@ quarantine:
| Knob | Before | After | Attribution |
|------|--------|-------|-------------|
| `CONFIG_SECURITY_YAMA` | unset (but `CONFIG_LSM` listed yama) | `=y` | Graphene/AXP LSM stack; ptrace scope |
| `CONFIG_SECURITY_YAMA` | unset (but `CONFIG_LSM` listed yama) | unset | GOLDEN 4.14.355 config: not set |
| `CONFIG_SLAB_FREELIST_RANDOM` | unset | `=y` | Graphene/AH slab hardening companion to existing `SLAB_FREELIST_HARDENED` |
Yama was `=y` from `162840Z` until 2026-10-10. With `apply_009_yama_ptrace.py`
init set `ptrace_scope=2`, which denies PairIP's self-ptrace. Wallapop then
died with SIGSEGV right after `libpairipcore.so` loaded. dmesg showed
`ptrace attach of "com.wallapop"[…] was attempted by "com.wallapop"[…]`.
With `persist.native_debug=true` (scope 0), LAB passed PairIP. GOLDEN has no
Yama, so AXP's init writes are inert there. The AXP init/sepolicy patch stays,
inert in the same way.
## Apply
```bash
@@ -28,17 +36,12 @@ Stage1+combo4+CVE apply.
## LAB verify
```text
zcat /proc/config.gz | grep CONFIG_SECURITY_YAMA=y
zcat /proc/config.gz | grep 'CONFIG_SECURITY_YAMA is not set'
zcat /proc/config.gz | grep CONFIG_SLAB_FREELIST_RANDOM=y
cat /proc/sys/kernel/yama/ptrace_scope # expect 2 (ship policy)
ls /proc/sys/kernel/yama # expect: no such file
pidof magiskd # still up
```
The ship script now applies `apply_009_yama_ptrace.py`, so the current LAB
policy is `ptrace_scope=2`, not the kernel default `1`. Matching AXP's
`persist.native_debug` 0/2 toggle is a separate userspace change and must not
be mixed into the CVE-2022-49980 boot test.
## Out of scope here
- The original `CVE-2022-49980/ANY/0001.patch` remains denylisted. The next