# Gate G / FR-017 — kernel hardening attribution (ship candidate)

> **Measured LAB closure (2026-10-09):** `user` + `release-keys` + Magisk 30.7
> pack — see [`009-closure-parity-20261009.md`](009-closure-parity-20261009.md).
> Tables below that still say Oct-1 / “userspace Gate G open / test-keys” are
> **historical acceptance**; prefer closure for current props.

**What “Gate G doc” means:** the acceptance contract asks for a written list of
**what kernel hardening we applied, what we skipped and why**, plus userspace
AVB/signing gaps (or “impossible on this stack”). This file is that list for the
**kernel** half. Userspace AVB is tracked separately below as still open.

**LAB device:** `11231JEC207477` only.  

> **2026-10-07 correction / next bacon:** LAB currently runs the
> `20261007T133154Z` PRO/user/release-keys artifact. Audit found that Stage1
> treated `misc/0021` as reversed and silently changed the LOS base's
> `KSYM_NAME_LEN` from 192 to 128 while `CONFIG_CFI_CLANG=y`. The next recipe
> removes that already-present patch, invokes Stage1 with `patch --forward`,
> and gates `KSYM_NAME_LEN=192`. Artifact `20261007T161115Z` is quarantined
> and must not be flashed. Its corrected replacement,
> `20261007T171530Z`, completed all artifact gates and keeps the original CVE
> one-liner denylisted while testing only the lock-scope companion as the new
> kernel delta. It remains **unflashed** pending LAB USB-gadget acceptance.
> The historical acceptance record below remains unchanged.

**Accepted kernel ship pack (LAB 2026-10-01):** Stage1 Graphene/AH + combo4 +
Clang FORTIFY + Magisk preroot + **CVE clean-offset 429** + **hi-batch1+2 (15)**
with `CVE-2022-49980` denylisted. Clean-only `#47` / hi-batch1 `#48` remain bisect GOODs.

Prior Stage1-only pack `20260929T123401Z-axp-stage1-combo4` remains the
**recover / bisect GOOD** baseline (kernel `#32`).

## Current accepted artifact

| Field | Value |
|--------|--------|
| Artifact | `/srv/rom/artifacts/009-axp-los23-port/20261001T201836Z-axp-stage1-combo4-cve-hi-batch2/` |
| Local flash copy | `.local-artifacts/009-flash-cve-hi-batch2/` |
| Prior hi-batch1 GOOD | `20261001T192418Z-…-cve-hi-batch1/` (`#48`) |
| Prior clean GOOD | `20261001T180955Z-…-cve-clean/` (`#47`) |
| Kernel base | LOS `msm-4.14` `@ 28f9290ae067` (`4.14.357-openela`) |
| Running LAB (boot flash) | slot `_a`, kernel `#49` `Thu Oct 1 19:49:54 UTC 2026` |
| CVE list | clean **429** + hi-batch1 (**7**) + hi-batch2 (**8**) |
| Apply quality | clean OK=429; hi OK=15 fuzz≤1 (elevated abs-offset) |
| Note | host detach `exit=141` after `bacon_exit=0` = tee SIGPIPE, not a real fail |
| Magisk | EXTENDROM-class preroot v30.7 (virgin until Additional Setup; `magiskd` OK) |
| KernelSU | absent (Magisk track) |

**Flash procedure that works:** recovery → (optional wipe) → sideload zip →
**Reboot system**. Bisect/CVE boots may use `fastboot -s 11231JEC207477 flash boot`
only when CRC/modules match the installed vendor. Do **not** flash Magisk
`boot.img` onto the other slot alone (new kernel + old vendor ⇒ `wlan` CRC mismatch).

**Build entrypoints:**

- Apply: `apply_stage1_combo4.sh` then `apply_cve_strict.sh` with
  `CVE_STRICT_LIST=…/cve-clean-offset.list` (denylist includes 49980)
- Bacon: `scripts/009-bacon-axp-stage1-combo4-cve-clean.sh` (or
  `009-bacon-cve-clean-post49980` host wrapper)
- Baseline-only: `scripts/009-bacon-axp-stage1-combo4.sh`

## Applied (attributable)

### A. Combo4 defconfig + Clang FORTIFY port

| Item | Source / notes |
|------|----------------|
| `CONFIG_FORTIFY_SOURCE=y` | Ship; Clang port required on this toolchain |
| `CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y` | Combo4 |
| `CONFIG_INIT_ON_FREE_DEFAULT_ON=y` | Combo4 |
| `CONFIG_SECURITY_DMESG_RESTRICT=y` | Combo4 |
| `CONFIG_SLAB_FREELIST_HARDENED=y` | Combo4 (not `SLAB_HARDENED` alone) |
| Clang FORTIFY / `__pass_object_size` | `fortify-clang/apply_fortify_clang.py` (Kees-class port adapted to 4.14 `string.h`) |
| Nested strlen fix | `strlcpy`/`strcpy` use `__underlying_strlen(q)` — LAB smoking gun 2026-09-28 |
| Driver bounds | `fortify-clang/0001-driver-bounds-rtac-fils.patch` (link/false-path) |
| `# CONFIG_KSU is not set` | Magisk track |

### B. Stage1 Graphene / AndroidHardening (30 patches)

Source tree: AXP `kernel_patches` (host `/srv/rom/references/axp/kernel_patches`).  
List: `vendor/sunfish-a16/patches/009-kernel-hardening/stage1.list` via
`apply_stage1.sh`.

Includes (series names): Deny_USB, allocsize (partial), bugon, fortify
strict-string patch (AXP `0004` — **not** a substitute for the Clang port),
misc, random, ro, sanitize, slab, unused, etc. Full paths in `stage1.list`.

**LAB marker:** `/proc/sys/kernel/deny_new_usb` present (Graphene Deny USB).

**Build fix retained:** Stage1 `slab/0014` misfuzz into `is_root_cache` →
reverted in `apply_stage1_combo4.sh` when detected (`BUILD-FIXES.md`).

## Explicitly NOT in this ship pack

| Item | Why |
|------|-----|
| Full `cve-strict.list` (~503) | Logo hang; includes high-offset (≥200) and `CVE-2022-49980`. Do not reflash `20260929T181525Z-…-cve` / old `*-kh-cve`. |
| `CVE-2022-49980` (USB gadget UAF) | **Denylist.** Alone reproduces Google-logo hang on LAB (2026-10-01). One-liner takes `udc_lock` in `usb_udc_uevent` while this 4.14 tree still fires uevents under the same lock (`device_add` / bind / unbind). Needs lock-scope companion port, not bulk apply. See `docs/009-cve-bisect-plan.md`. |
| High-offset CVE set (`cve-high-offset-ge200.txt`, ~73) | Quarantine + sunfish filter (26 KEEP). **hi-batch1+2 (15) LAB BOOT_OK `#49`**. Remaining KEEP ~10 (skip `3777`/`26643` nf_tables-class). |
| LinuxIncrementals | Skipped (policy / scope) |
| Failed Stage1 probes | allocsize/0007, ro/0007+0034, slab/0010+0018 — port later |
| Location lockdown | FR-018 — **skip forever on this track**; keep GPS precise/fast (LOS defaults) |
| FORTIFY `BUG()` overflow stubs | Invalid ship fix; never reuse |
| KernelSU / SusFS | Out of Magisk ship track (optional later recycle) |
| Userspace Deblob (Widevine/IMS/CNE) | Deferred (mobile data / Widevine) |
| Bootloader lock | Wont (AXP/LOS unlocked norm) |

## Historical note (why this pack exists)

1. Stage1 / CVE / kh-full bacons of 2026-09-18 **compiled** but **did not boot** on LAB (logo hang).  
2. Bisect found Clang FORTIFY + nested `strlen` inside `strlcpy` as a hard brick; combo4 without broken FORTIFY booted.  
3. Fixed FORTIFY → combo4+FORTIFY Magisk bacon OK → Stage1 **re-tried on that baseline** → LAB OK 2026-09-29.

## Userspace Gate G (still open)

Kernel attribution above satisfies the **FR-017 / SC-010 kernel** bullet.
Userspace / signing work is **not** done by this kernel bacon.

### In scope (do)

| Item | Intent |
|------|--------|
| **Release / definitive signing keys** | Ship OTAs and images signed with project release keys (not AOSP test-keys). Phonesky and update identity stay on that key across releases. Secrets stay on `rom-dev01` under `/srv/rom/secrets/` — never in Git. |
| **AVB as applicable on unlocked sunfish** | Match GOLDEN/AXP-class AVB *build* posture where LOS 23.2 allows; document any gap that is impossible without locked bootloader or vendor glue we do not have. |
| **Userspace hardening** | Staged Graphene/AXP-class patches (and CVE mega on the boot-OK kernel pack) — attributable, bisectable. |
| **CVE mega (kernel)** | **Partial ship:** clean-offset 429 on Stage1+combo4+FORTIFY (LAB OK). Remaining: high-offset quarantine + proper 49980 port. Never flash `20260918*-kh-cve/full` or full-503 BAD packs. |

### Out of scope (explicit skip)

| Item | Why |
|------|-----|
| **Bootloader relock / locked-device ship** | Neither **AXP.OS** nor **LineageOS** ship a locked-bootloader product as the normal path. **IOdes** does; we are not cloning that model. LAB and end-user sunfish remain **unlocked** for Magisk preroot / sideload workflow. Do **not** treat “cannot lock bootloader” as a Gate G failure. |

Gap rule unchanged: anything still missing from the **in-scope** rows must be present **or** written down as impossible on this stack — no silent omit.

**Checklist + measured GOLDEN vs LAB:** `docs/009-hardening-signing-checklist.md`
(T040). LAB 2026-09-29 is still `userdebug`/`test-keys`/`orange`; GOLDEN is
`user`/`release-keys`/`orange` unlocked — same unlock class, missing project
keys.

## Prior known-good (fallback)

| Artifact | Role |
|----------|------|
| `20260929T033128Z-axp-combo4-fortify` | Magisk + combo4+FORTIFY **without** Stage1 |
| `20260918T143547Z-axp-full` | Pre-KH Magisk baseline (bisect GOODMAKE source) |

## Owner LAB smoke (2026-09-29)

Owner reported Magisk, microG, and related checks OK on Stage1 pack after
sideload to slot `_b`. Optional: second sideload to refresh leftover slot `_a`
(not required for daily use).