0 Fork 0

Files

T

sunfish-adminandCursor 2d145c2878 009: Polish bacon fixes, OTA host scripts, and migration docs.

Restore disable_configstore, EuiccDisabler and thermal CDEV guards, branding
and rebuild/sync helpers; document device roles, laptop migration, and Gitea.

Co-authored-by: Cursor <cursoragent@cursor.com>

2026-10-16 21:06:45 +02:00

1.9 KiB

Raw Permalink Blame History

US-S4 — Userspace hardening (first stage)

Status 2026-10-02. No bacon solely for this doc.

Stage 0 — LAB baseline (measure, closed)

On LAB 11231JEC207477 after AVB ship 20261002T103558Z (+ boot/vbmeta reinforce):

Check	Result
SELinux	Enforcing
Encryption	`ro.crypto.state=encrypted`, `ro.crypto.type=file`
Verified boot	orange / `flash.locked=0` (unlocked Magisk track)
`security.perf_harden`	1 (already)
Yama / `ptrace_scope`	off like GOLDEN (reverted 2026-10-10: scope 2 broke PairIP)

Stage 1 — US-S4-1 drop product OpenSSH / rsync / procmem

Oracle: AXP.OS-22.2-20260324-PRO-sunfish.zip product (+ system) images — no sshd/ssh/rsync/procmem binaries; orphan init.openssh.rc only.

Shipped in tree: vendor/sunfish-a16/hardening.mk + patches/009-axp-los23-port/hardening/README.md.

Removes Lineage product OpenSSH binaries + rsync, procmem (DEBUG). Keeps init.openssh.rc (AXP PRO still has it). Admin path: adb + Magisk.

LAB verify after flash: no /product/bin/sshd, no /product/bin/rsync, /product/etc/init/init.openssh.rc present, Magisk still up.

Stage 2 — US-S4-2 drop Jelly + Gallery2

Oracle: AXP PRO product has neither; Fossify on system_ext. See docs/009-axp-pro-product-apps-20260324.md.

Wired: apply_009_drop_jelly_gallery2.py, NoLineageJelly phony override, hardening.mk filter, bacon gate. Pending next bacon + LAB.

Later candidates (one per bacon when risk unclear)

Mount / noexec where stock sunfish already allows (verify HW first)
Package-visibility / query hardening (high app-compat risk → later)
Further debug-tool trim (adb_root only if LAB proves unused)

Promote from docs/hardening-backlog.md only with upstream attribution.

Out of scope here

WITH_AVB=true / flags 0
Bootloader relock
lineage_sunfish-user default lunch (US-S6)
Kernel Yama / more CVE (US-S5)

1.9 KiB Raw Permalink Blame History