#!/bin/bash
# US-S5-1 — remaining Graphene/AXP-class defconfig knobs on msm-4.14.
#
# SLAB_FREELIST_RANDOM: LOS sunfish_defconfig leaves it off (combo4 already
# ships SLAB_FREELIST_HARDENED).
#
# SECURITY_YAMA: GOLDEN's running 4.14.355 config leaves it unset, so AXP's
# init ptrace_scope writes are inert there. With Yama built, scope 2 denies
# PairIP's self-ptrace (Wallapop SIGSEGV, LAB 2026-10-10). Match GOLDEN.
#
# Does NOT apply high-offset CVE leftovers (nf_tables deliberately skipped).
# CVE-2022-49980's one-liner stays on the denylist. The bacon applies
# ports/cve-2022-49980-lock-scope.patch after the CVE lists.
#
# USERFAULTFD: GOLDEN's running 4.14.355 config leaves it unset. LOS 23
# sunfish_defconfig turns it on. This kernel has no UFFDIO_MOVE (that ioctl
# is 6.1+), so ART only opens a fd and times out. Match GOLDEN.
#
# MEMCG / CGROUP_PIDS: Android 16 mounts cgroup v2 and attempts per-UID memory
# and PID controller activation. The old sunfish defconfig leaves both off,
# which produces `+memory ... Invalid argument` at runtime. Enable the native
# 4.14 controllers for the next candidate.
#
# LOCALVERSION_AUTO: the kernel source is intentionally patched in the build;
# do not expose the source worktree's incidental `-dirty` suffix in uname.
#
# Usage: apply_uss5_1_defconfig.sh <kernel-tree>
set -euo pipefail

K=${1:?kernel tree}
DEF="$K/arch/arm64/configs/sunfish_defconfig"
test -f "$DEF"

for k in SECURITY_YAMA SLAB_FREELIST_RANDOM USERFAULTFD HAVE_ARCH_USERFAULTFD_MINOR \
         MEMCG CGROUP_PIDS LOCALVERSION_AUTO; do
  sed -i "/CONFIG_${k}/d" "$DEF"
done

{
  echo "# CONFIG_SECURITY_YAMA is not set"
  echo "CONFIG_SLAB_FREELIST_RANDOM=y"
  echo "# CONFIG_USERFAULTFD is not set"
  echo "CONFIG_MEMCG=y"
  echo "CONFIG_CGROUP_PIDS=y"
  echo "# CONFIG_LOCALVERSION_AUTO is not set"
} >> "$DEF"

echo "OK: US-S5-1 defconfig (SLAB_FREELIST_RANDOM; MEMCG, CGROUP_PIDS on; YAMA, USERFAULTFD, LOCALVERSION_AUTO off) on $K"