AXP-Resurection/scripts/009-bacon-axp-combo4-fortify.sh

#!/bin/bash
# 009 bacon — AXP Magisk preroot + combo4+Clang-FORTIFY kernel (LAB-verified pack).
# Does NOT apply Graphene Stage1 mega-pack (not boot-OK yet on LOS23/Clang).
set -e
cd /srv/rom/src/lineage
export HOME=/home/android-build
export CCACHE_DIR=/srv/rom/ccache
export USE_CCACHE=1
export PATH=/home/android-build/bin:/usr/local/bin:/usr/bin:/bin:$PATH
export ANDROID_BUILD_TOP=/srv/rom/src/lineage
unset OUT_DIR || true
export SUNFISH_A16_MAGISK_PREROOT=1
export MAGISK_APK=/srv/rom/prebuilts/magisk/Magisk-v30.7.apk

LOGDIR=/srv/rom/logs/009-build
mkdir -p "$LOGDIR"
LOG=$LOGDIR/bacon-axp-combo4-fortify.log
exec > >(tee -a "$LOG") 2>&1

echo "=== START 009-bacon-axp-combo4-fortify $(date -Is) ==="

LIVE=kernel/google/msm-4.14
BASE=28f9290ae067
test -d "$LIVE"

echo "=== reset kernel @ $BASE ==="
git -C "$LIVE" reset --hard "$BASE"
git -C "$LIVE" clean -fdq

APPLY=vendor/sunfish-a16/patches/009-kernel-hardening/apply_combo4_fortify.sh
test -x "$APPLY" || chmod +x "$APPLY"
bash "$APPLY" "$LIVE"

DEF=$LIVE/arch/arm64/configs/sunfish_defconfig
if grep -qE "^CONFIG_KSU.*=y" "$DEF"; then
  echo "FAIL: $DEF still enables KernelSU" >&2
  exit 1
fi
for k in FORTIFY_SOURCE INIT_ON_ALLOC_DEFAULT_ON INIT_ON_FREE_DEFAULT_ON \
         SECURITY_DMESG_RESTRICT SLAB_FREELIST_HARDENED; do
  if ! grep -q "^CONFIG_${k}=y" "$DEF"; then
    echo "FAIL: missing CONFIG_${k}=y" >&2
    exit 1
  fi
done
grep -q "ret = __underlying_strlen(q);" "$LIVE/include/linux/string.h"
echo "OK: combo4+FORTIFY markers + nested-strlen fix present"

rm -f out/target/product/sunfish/obj/KERNEL_OBJ/arch/arm64/boot/Image.lz4 \
      out/target/product/sunfish/obj/KERNEL_OBJ/arch/arm64/boot/Image \
      out/target/product/sunfish/kernel
echo "OK: cleared prior Image for kernel rebuild"

# FLAG_SECURE + Settings UX (idempotent)
python3 vendor/sunfish-a16/patches/008-call-rec-flag-secure/apply_wms_disable_secure_debuggable_gate.py
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_disable_user_apps.py
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_private_dns_providers.py
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_connectivity_check.py

PH=/srv/rom/src/lineage/vendor/sunfish-a16/prebuilt/Phonesky.apk
test -e "$PH"
AAPT=/srv/rom/src/lineage/prebuilts/sdk/tools/linux/bin/aapt
if ! "$AAPT" dump permissions "$PH" 2>/dev/null | grep -q USE_EXACT_ALARM; then
  echo "FAIL: Phonesky missing USE_EXACT_ALARM" >&2
  exit 1
fi
echo "OK: Phonesky has USE_EXACT_ALARM"

MAGISK_STAGE_DIR=/srv/rom/src/lineage/out/.magisk \
  vendor/sunfish-a16/magisk/prepare_magisk.sh
python3 vendor/sunfish-a16/magisk/apply_releasetools_hook.py --top "$ANDROID_BUILD_TOP" --force
test -f out/.magisk/READY

rm -rf out/soong/.intermediates/build/make/tools/releasetools/releasetools_common
rm -rf out/soong/.intermediates/build/make/tools/releasetools/add_img_to_target_files
rm -rf out/target/product/sunfish/obj/PACKAGING/target_files_intermediates
rm -f out/target/product/sunfish/lineage-*.zip \
      out/target/product/sunfish/boot.img \
      out/target/product/sunfish/system/priv-app/Phonesky/Phonesky.apk
touch frameworks/base/services/core/java/com/android/server/wm/WindowManagerService.java

set +u
# shellcheck disable=SC1091
source build/envsetup.sh
set -e
breakfast sunfish userdebug
test "${TARGET_RELEASE:-}" = "bp4a"

echo "=== mka bacon $(date -Is) ==="
set -o pipefail
mka bacon -j8
ec=${PIPESTATUS[0]}
echo "bacon_exit=$ec $(date -Is)"
[ "$ec" -eq 0 ] || exit "$ec"

PROD=out/target/product/sunfish
BID=$(date -u +%Y%m%dT%H%M%SZ)
DEST=/srv/rom/artifacts/009-axp-los23-port/${BID}-axp-combo4-fortify
mkdir -p "$DEST"

TF_BOOT=$(find "$PROD/obj/PACKAGING/target_files_intermediates" -path "*/IMAGES/boot.img" 2>/dev/null | head -1)
MAKE_BOOT=$PROD/boot.img
if [ -n "${TF_BOOT:-}" ] && [ -f "$TF_BOOT" ]; then
  cp -v "$TF_BOOT" "$DEST/boot.img"
  cp -v "$MAKE_BOOT" "$DEST/boot-make.img" 2>/dev/null || true
  echo "boot_source=target_files_IMAGES"
else
  cp -v "$MAKE_BOOT" "$DEST/boot.img"
  echo "WARN: no TF IMAGES/boot.img — using Make boot"
fi

cp -v "$PROD"/lineage-*-UNOFFICIAL-sunfish.zip "$DEST/" 2>/dev/null || true
for f in vbmeta.img dtbo.img; do
  [ -f "$PROD/$f" ] && cp -v "$PROD/$f" "$DEST/"
done

# Magisk present, KernelSU absent
MB=out/.magisk/magiskboot
if [ -x "$MB" ]; then
  rm -rf "$DEST/boot-check" && mkdir -p "$DEST/boot-check"
  if "$MB" unpack "$DEST/boot.img" "$DEST/boot-check" >/dev/null 2>&1; then
    if [ -f "$DEST/boot-check/ramdisk.cpio" ]; then
      if "$MB" cpio "$DEST/boot-check/ramdisk.cpio" "exists overlay.d/sbin/magisk64.xz" \
           || "$MB" cpio "$DEST/boot-check/ramdisk.cpio" "exists overlay.d/sbin/magisk.xz"; then
        echo "OK: Magisk overlay in boot.img"
      else
        echo "WARN: Magisk overlay not detected in boot.img ramdisk"
      fi
    fi
  else
    echo "WARN: magiskboot unpack failed (host SIGILL flake possible); skip TF check"
  fi
fi
if strings "$DEST/boot.img" | grep -qiE 'KernelSU|CONFIG_KSU_SUSFS'; then
  echo "FAIL: KernelSU strings in boot.img" >&2
  exit 1
fi
echo "OK: no KernelSU strings in boot.img"

{
  echo "artifact=$DEST"
  echo "kernel_base=$BASE"
  echo "hardening=combo4+clang-fortify (nested __underlying_strlen)"
  echo "magisk=preroot EXTENDROM-class v30.7"
  echo "stage1_graphene=NOT_INCLUDED (not boot-OK on LOS23 yet)"
  date -u +"built=%Y-%m-%dT%H:%M:%SZ"
} | tee "$DEST/README.txt"

(cd "$DEST" && sha256sum boot.img boot-make.img lineage-*-UNOFFICIAL-sunfish.zip 2>/dev/null || true) \
  | tee "$DEST/SHA256SUMS"

echo "=== DONE $DEST $(date -Is) ==="