# 009 kernel hardening Stage 1 (FR-017)

**Source**: AXP `kernel_patches` @ `df3cab2155b3` (GrapheneOS / AndroidHardening
series in Divest-era layout).  
**Base**: LOS `kernel/google/msm-4.14` @ `28f9290ae067` (`4.14.357-openela`).  
**Map**: `docs/009-kernel-hardening-map.md`.

## Files

| File | Role |
|------|------|
| `stage1.list` | Ordered allowlist (30 patches) |
| `apply_stage1.sh` | Applies list onto a kernel tree |

## Host usage (`rom-dev01`)

```bash
# dry-run
bash vendor/sunfish-a16/patches/009-kernel-hardening/apply_stage1.sh \
  /srv/rom/src/lineage/kernel/google/msm-4.14 --dry-run

# apply (dirties the lineage kernel checkout)
bash vendor/sunfish-a16/patches/009-kernel-hardening/apply_stage1.sh \
  /srv/rom/src/lineage/kernel/google/msm-4.14
```

Optional: `AXP_KERNEL_PATCHES=/path/to/kernel_patches`.

After apply, flip `sunfish_defconfig` options that the new Kconfig allows
(at least `CONFIG_FORTIFY_SOURCE=y`); see map `KH-CFG`.

## Boot-OK pack (2026-09-28 LAB) — prefer for Magisk bacon

Stage1 Graphene alone historically hung at the Google logo on LOS23/Clang.
The pack that boots with Magisk-track `boot-make` is **combo4 + Clang FORTIFY**
(no Stage1 mega-pack):

```bash
# on a reset msm-4.14 @ 28f9290ae067:
bash vendor/sunfish-a16/patches/009-kernel-hardening/apply_combo4_fortify.sh \
  /path/to/msm-4.14
```

That applies `fortify-clang/` (incl. nested `__underlying_strlen` fix) +
driver bounds + defconfig:
`FORTIFY_SOURCE`, `INIT_ON_*`, `SECURITY_DMESG_RESTRICT`,
`SLAB_FREELIST_HARDENED`. Bacon entrypoint:
`scripts/009-bacon-axp-combo4-fortify.sh`.

## Stage1 + combo4 (full bacon, Wi‑Fi coherent)

```bash
# reset msm-4.14 @ 28f9290ae067, then:
bash vendor/sunfish-a16/patches/009-kernel-hardening/apply_stage1_combo4.sh \
  /path/to/msm-4.14
# bacon: scripts/009-bacon-axp-stage1-combo4.sh
```

Order: Stage1 (30) → slab BUILD-FIXES if needed → combo4+FORTIFY.
Ship via **sideload of the zip** (matching vendor/`wlan.ko`). Do not flash
only the new boot onto an old slot.

**LAB accepted 2026-09-29:** see `docs/009-gate-g-kernel-attribution.md`.

## GPS / location (FR-018 — do not regress)

Owner wants **precise, fast GPS** (stock LOS behaviour). **Never** apply AXP
location lockdown, SUPL/IMSI stripping that hurts TTFF, or extra location
caps vs LOS 23.2. Stage1 list, `cve-strict.list`, and denylist must stay
free of location-lockdown series (`KH-LOC` = skip). If a future CVE hunk
touches GNSS/GPS paths only for a real security fix, keep LOS-equivalent
behaviour and document; do not “harden location” as a side goal.

## Not in Stage 1 alone

- CVE mega — now staged via `apply_stage1_combo4_cve.sh` + `cve-strict.list`
  (~503 AXP allowlist from 2026-09-18 strict pass; `cve-denylist.txt` skipped).
  Bacon: `scripts/009-bacon-axp-stage1-combo4-cve.sh` (test-keys; after
  boot-OK Stage1 pack). **Do not** flash `20260918*-axp-kh-cve/full`.
- LinuxIncrementals
- Failed probe patches (port later)
- Location lockdown (FR-018)
- Iodé kernel (no sunfish 4.14 fork found)