# US-S4 — Userspace hardening (first stage)

Status 2026-10-02. No bacon solely for this doc.

## Stage 0 — LAB baseline (measure, closed)

On LAB `11231JEC207477` after AVB ship `20261002T103558Z` (+ boot/vbmeta reinforce):

| Check | Result |
|-------|--------|
| SELinux | Enforcing |
| Encryption | `ro.crypto.state=encrypted`, `ro.crypto.type=file` |
| Verified boot | orange / `flash.locked=0` (unlocked Magisk track) |
| `security.perf_harden` | 1 (already) |
| Yama / `ptrace_scope` | **done** (US-S5-1 `162840Z`) — `CONFIG_SECURITY_YAMA=y` |

## Stage 1 — US-S4-1 drop product OpenSSH / rsync / procmem

**Oracle**: `AXP.OS-22.2-20260324-PRO-sunfish.zip` product (+ system) images —
no `sshd`/`ssh`/`rsync`/`procmem` binaries; orphan `init.openssh.rc` only.

**Shipped in tree**: `vendor/sunfish-a16/hardening.mk` +
`patches/009-axp-los23-port/hardening/README.md`.

Removes Lineage product OpenSSH binaries + `rsync`, `procmem` (DEBUG).
**Keeps** `init.openssh.rc` (AXP PRO still has it). Admin path: adb + Magisk.

LAB verify after flash: no `/product/bin/sshd`, no `/product/bin/rsync`,
`/product/etc/init/init.openssh.rc` present, Magisk still up.

## Stage 2 — US-S4-2 drop Jelly + Gallery2

**Oracle**: AXP PRO product has neither; Fossify on system_ext. See
`docs/009-axp-pro-product-apps-20260324.md`.

Wired: `apply_009_drop_jelly_gallery2.py`, `NoLineageJelly` phony override,
hardening.mk filter, bacon gate. Pending next bacon + LAB.

## Later candidates (one per bacon when risk unclear)

1. Mount / noexec where stock sunfish already allows (verify HW first)
2. Package-visibility / query hardening (high app-compat risk → later)
3. Further debug-tool trim (`adb_root` only if LAB proves unused)

Promote from `docs/hardening-backlog.md` only with upstream attribution.

## Out of scope here

- `WITH_AVB=true` / flags 0
- Bootloader relock
- `lineage_sunfish-user` default lunch (US-S6)
- Kernel Yama / more CVE (US-S5)