009: Magisk ship pack through US-S5-1 + US-S4 OpenSSH/Jelly/Gallery2.

Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding, bundled apps, and AXP-class product surface docs/scripts.
2026-10-05 10:42:00 +02:00
1 parent fd793b9471
commit deaaf42caa
@@ -0,0 +1,42 @@
+# US-S5-1 — Yama + SLAB freelist random (defconfig)
+
+**Track**: AXP Resurection Pro Magisk, unlocked sunfish.  
+**On top of**: Stage1 + combo4 + FORTIFY + CVE clean-429 + hi-batch1–3.
+
+## Why
+
+High-offset KEEP CVEs are already on the ship pack. Remaining ge200 KEPT
+items were **nf_tables** (`CVE-2023-3777`, `CVE-2024-26643`) — skipped on
+purpose in batch3. Next attributable kernel depth without reopening CVE
+quarantine:
+
+| Knob | Before | After | Attribution |
+|------|--------|-------|-------------|
+| `CONFIG_SECURITY_YAMA` | unset (but `CONFIG_LSM` listed yama) | `=y` | Graphene/AXP LSM stack; ptrace scope |
+| `CONFIG_SLAB_FREELIST_RANDOM` | unset | `=y` | Graphene/AH slab hardening companion to existing `SLAB_FREELIST_HARDENED` |
+
+## Apply
+
+```bash
+bash vendor/sunfish-a16/patches/009-kernel-hardening/apply_uss5_1_defconfig.sh \
+  kernel/google/msm-4.14
+```
+
+Wired into `scripts/009-bacon-axp-stage1-combo4-cve-hi-releasekeys.sh` after
+Stage1+combo4+CVE apply.
+
+## LAB verify
+
+```text
+zcat /proc/config.gz | grep CONFIG_SECURITY_YAMA=y
+zcat /proc/config.gz | grep CONFIG_SLAB_FREELIST_RANDOM=y
+cat /proc/sys/kernel/yama/ptrace_scope   # expect 1 (default)
+pidof magiskd                            # still up
+```
+
+## Out of scope here
+
+- `CVE-2022-49980` lock-scope port (still denylist)
+- nf_tables high-offset CVEs
+- Stage1 slab FAIL patches (`0010`/`0018` still reject on this tree)
+- `hardened_malloc` / bootloader lock