sunfish-adminandCursor
2d145c2878
Restore disable_configstore, EuiccDisabler and thermal CDEV guards, branding and rebuild/sync helpers; document device roles, laptop migration, and Gitea. Co-authored-by: Cursor <cursoragent@cursor.com>
53 lines
1.9 KiB
Markdown
53 lines
1.9 KiB
Markdown
# US-S4 — Userspace hardening (first stage)
|
|
|
|
Status 2026-10-02. No bacon solely for this doc.
|
|
|
|
## Stage 0 — LAB baseline (measure, closed)
|
|
|
|
On LAB `11231JEC207477` after AVB ship `20261002T103558Z` (+ boot/vbmeta reinforce):
|
|
|
|
| Check | Result |
|
|
|-------|--------|
|
|
| SELinux | Enforcing |
|
|
| Encryption | `ro.crypto.state=encrypted`, `ro.crypto.type=file` |
|
|
| Verified boot | orange / `flash.locked=0` (unlocked Magisk track) |
|
|
| `security.perf_harden` | 1 (already) |
|
|
| Yama / `ptrace_scope` | **off like GOLDEN** (reverted 2026-10-10: scope 2 broke PairIP) |
|
|
|
|
## Stage 1 — US-S4-1 drop product OpenSSH / rsync / procmem
|
|
|
|
**Oracle**: `AXP.OS-22.2-20260324-PRO-sunfish.zip` product (+ system) images —
|
|
no `sshd`/`ssh`/`rsync`/`procmem` binaries; orphan `init.openssh.rc` only.
|
|
|
|
**Shipped in tree**: `vendor/sunfish-a16/hardening.mk` +
|
|
`patches/009-axp-los23-port/hardening/README.md`.
|
|
|
|
Removes Lineage product OpenSSH binaries + `rsync`, `procmem` (DEBUG).
|
|
**Keeps** `init.openssh.rc` (AXP PRO still has it). Admin path: adb + Magisk.
|
|
|
|
LAB verify after flash: no `/product/bin/sshd`, no `/product/bin/rsync`,
|
|
`/product/etc/init/init.openssh.rc` present, Magisk still up.
|
|
|
|
## Stage 2 — US-S4-2 drop Jelly + Gallery2
|
|
|
|
**Oracle**: AXP PRO product has neither; Fossify on system_ext. See
|
|
`docs/009-axp-pro-product-apps-20260324.md`.
|
|
|
|
Wired: `apply_009_drop_jelly_gallery2.py`, `NoLineageJelly` phony override,
|
|
hardening.mk filter, bacon gate. Pending next bacon + LAB.
|
|
|
|
## Later candidates (one per bacon when risk unclear)
|
|
|
|
1. Mount / noexec where stock sunfish already allows (verify HW first)
|
|
2. Package-visibility / query hardening (high app-compat risk → later)
|
|
3. Further debug-tool trim (`adb_root` only if LAB proves unused)
|
|
|
|
Promote from `docs/hardening-backlog.md` only with upstream attribution.
|
|
|
|
## Out of scope here
|
|
|
|
- `WITH_AVB=true` / flags 0
|
|
- Bootloader relock
|
|
- `lineage_sunfish-user` default lunch (US-S6)
|
|
- Kernel Yama / more CVE (US-S5)
|