#!/bin/bash
# US-S5-1 — enable remaining Graphene/AXP-class defconfig knobs on msm-4.14.
#
# Oracle: AXP/Graphene kernel hardening expects Yama + slab freelist random
# (combo4 already ships SLAB_FREELIST_HARDENED). LOS sunfish_defconfig left both
# off; CONFIG_LSM already lists yama but SECURITY_YAMA was unset so the LSM
# never built.
#
# Does NOT apply high-offset CVE leftovers (nf_tables deliberately skipped) or
# CVE-2022-49980 (denylist until lock-scope port).
#
# Usage: apply_uss5_1_defconfig.sh <kernel-tree>
set -euo pipefail

K=${1:?kernel tree}
DEF="$K/arch/arm64/configs/sunfish_defconfig"
test -f "$DEF"
test -f "$K/security/yama/Kconfig"

for k in SECURITY_YAMA SLAB_FREELIST_RANDOM; do
  sed -i "/CONFIG_${k}/d" "$DEF"
  # drop "# CONFIG_FOO is not set" lines too (sed above only matches CONFIG_FOO=)
  sed -i "/# CONFIG_${k} is not set/d" "$DEF"
done

{
  echo "CONFIG_SECURITY_YAMA=y"
  echo "CONFIG_SLAB_FREELIST_RANDOM=y"
} >> "$DEF"

echo "OK: US-S5-1 defconfig (YAMA + SLAB_FREELIST_RANDOM) on $K"