sunfish-admin
deaaf42caa
Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding, bundled apps, and AXP-class product surface docs/scripts.
163 lines
5.8 KiB
Bash
Executable File
163 lines
5.8 KiB
Bash
Executable File
#!/bin/bash
|
|
# 009 bacon — Stage1+combo4+FORTIFY + CVE clean + hi-batch1+2+3.
|
|
# Elevated CVE_MAX_ABS_OFFSET=9999 for high-offset lists. test-keys.
|
|
# Recover = hi-batch2 BOOT_OK boot.img.
|
|
set -e
|
|
cd /srv/rom/src/lineage
|
|
export HOME=/home/android-build
|
|
export CCACHE_DIR=/srv/rom/ccache
|
|
export USE_CCACHE=1
|
|
export PATH=/home/android-build/bin:/usr/local/bin:/usr/bin:/bin:$PATH
|
|
export ANDROID_BUILD_TOP=/srv/rom/src/lineage
|
|
unset OUT_DIR || true
|
|
export SUNFISH_A16_MAGISK_PREROOT=1
|
|
export MAGISK_APK=/srv/rom/prebuilts/magisk/Magisk-v30.7.apk
|
|
unset PRODUCT_DEFAULT_DEV_CERTIFICATE || true
|
|
|
|
LOGDIR=/srv/rom/logs/009-build
|
|
mkdir -p "$LOGDIR"
|
|
LOG=$LOGDIR/bacon-axp-stage1-combo4-cve-hi-batch3.log
|
|
exec > >(tee -a "$LOG") 2>&1
|
|
|
|
echo "=== START 009-bacon-axp-stage1-combo4-cve-hi-batch3 $(date -Is) ==="
|
|
|
|
LIVE=kernel/google/msm-4.14
|
|
BASE=28f9290ae067
|
|
KH=vendor/sunfish-a16/patches/009-kernel-hardening
|
|
LIST_CLEAN="$KH/cve-clean-offset.list"
|
|
LIST_HI1="$KH/cve-high-offset-batch1.list"
|
|
LIST_HI2="$KH/cve-high-offset-batch2.list"
|
|
LIST_HI3="$KH/cve-high-offset-batch3.list"
|
|
test -f "$LIST_CLEAN"
|
|
test -f "$LIST_HI1"
|
|
test -f "$LIST_HI2"
|
|
test -f "$LIST_HI3"
|
|
test -d "$LIVE"
|
|
|
|
echo "=== reset kernel @ $BASE ==="
|
|
git -C "$LIVE" reset --hard "$BASE"
|
|
git -C "$LIVE" clean -fdq
|
|
|
|
chmod +x "$KH"/apply_stage1_combo4.sh "$KH"/apply_cve_strict.sh \
|
|
"$KH"/apply_stage1.sh "$KH"/apply_combo4_fortify.sh 2>/dev/null || true
|
|
|
|
bash "$KH/apply_stage1_combo4.sh" "$LIVE"
|
|
|
|
export CVE_STRICT_LIST="$LIST_CLEAN"
|
|
unset CVE_STRICT_CONTINUE || true
|
|
export CVE_MAX_FUZZ=1
|
|
export CVE_MAX_ABS_OFFSET=200
|
|
bash "$KH/apply_cve_strict.sh" "$LIVE"
|
|
|
|
export CVE_MAX_ABS_OFFSET=9999
|
|
for L in "$LIST_HI1" "$LIST_HI2" "$LIST_HI3"; do
|
|
echo "=== high-offset $(basename "$L") ==="
|
|
export CVE_STRICT_LIST="$L"
|
|
bash "$KH/apply_cve_strict.sh" "$LIVE"
|
|
done
|
|
|
|
DEF=$LIVE/arch/arm64/configs/sunfish_defconfig
|
|
if grep -qE "^CONFIG_KSU.*=y" "$DEF"; then
|
|
echo "FAIL: KernelSU in defconfig" >&2
|
|
exit 1
|
|
fi
|
|
for k in FORTIFY_SOURCE INIT_ON_ALLOC_DEFAULT_ON INIT_ON_FREE_DEFAULT_ON \
|
|
SECURITY_DMESG_RESTRICT SLAB_FREELIST_HARDENED; do
|
|
grep -q "^CONFIG_${k}=y" "$DEF" || { echo "FAIL missing $k" >&2; exit 1; }
|
|
done
|
|
grep -q "ret = __underlying_strlen(q);" "$LIVE/include/linux/string.h"
|
|
grep -q "mmget_still_valid" "$LIVE/mm/madvise.c"
|
|
echo "OK: Stage1+combo4+FORTIFY + CVE-clean + hi-batch1+2+3 markers present"
|
|
|
|
rm -f out/target/product/sunfish/obj/KERNEL_OBJ/arch/arm64/boot/Image.lz4 \
|
|
out/target/product/sunfish/obj/KERNEL_OBJ/arch/arm64/boot/Image \
|
|
out/target/product/sunfish/kernel
|
|
|
|
python3 vendor/sunfish-a16/patches/008-call-rec-flag-secure/apply_wms_disable_secure_debuggable_gate.py
|
|
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_disable_user_apps.py
|
|
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_private_dns_providers.py
|
|
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_connectivity_check.py
|
|
|
|
PH=/srv/rom/src/lineage/vendor/sunfish-a16/prebuilt/Phonesky.apk
|
|
test -e "$PH"
|
|
AAPT=/srv/rom/src/lineage/prebuilts/sdk/tools/linux/bin/aapt
|
|
"$AAPT" dump permissions "$PH" 2>/dev/null | grep -q USE_EXACT_ALARM
|
|
|
|
MAGISK_STAGE_DIR=/srv/rom/src/lineage/out/.magisk \
|
|
vendor/sunfish-a16/magisk/prepare_magisk.sh
|
|
python3 vendor/sunfish-a16/magisk/apply_releasetools_hook.py --top "$ANDROID_BUILD_TOP" --force
|
|
test -f out/.magisk/READY
|
|
|
|
rm -rf out/soong/.intermediates/build/make/tools/releasetools/releasetools_common
|
|
rm -rf out/soong/.intermediates/build/make/tools/releasetools/add_img_to_target_files
|
|
rm -rf out/target/product/sunfish/obj/PACKAGING/target_files_intermediates
|
|
rm -f out/target/product/sunfish/lineage-*.zip \
|
|
out/target/product/sunfish/boot.img \
|
|
out/target/product/sunfish/system/priv-app/Phonesky/Phonesky.apk
|
|
touch frameworks/base/services/core/java/com/android/server/wm/WindowManagerService.java
|
|
|
|
set +u
|
|
# shellcheck disable=SC1091
|
|
source build/envsetup.sh
|
|
set -e
|
|
unset PRODUCT_DEFAULT_DEV_CERTIFICATE || true
|
|
breakfast sunfish userdebug
|
|
test "${TARGET_RELEASE:-}" = "bp4a"
|
|
|
|
echo "=== mka bacon $(date -Is) ==="
|
|
set -o pipefail
|
|
mka bacon -j8
|
|
ec=${PIPESTATUS[0]}
|
|
echo "bacon_exit=$ec $(date -Is)"
|
|
[ "$ec" -eq 0 ] || exit "$ec"
|
|
|
|
PROD=out/target/product/sunfish
|
|
BID=$(date -u +%Y%m%dT%H%M%SZ)
|
|
DEST=/srv/rom/artifacts/009-axp-los23-port/${BID}-axp-stage1-combo4-cve-hi-batch3
|
|
mkdir -p "$DEST"
|
|
|
|
TF_BOOT=$(find "$PROD/obj/PACKAGING/target_files_intermediates" -path "*/IMAGES/boot.img" 2>/dev/null | head -1)
|
|
MAKE_BOOT=$PROD/boot.img
|
|
if [ -n "${TF_BOOT:-}" ] && [ -f "$TF_BOOT" ]; then
|
|
cp -v "$TF_BOOT" "$DEST/boot.img"
|
|
cp -v "$MAKE_BOOT" "$DEST/boot-make.img" 2>/dev/null || true
|
|
else
|
|
cp -v "$MAKE_BOOT" "$DEST/boot.img"
|
|
fi
|
|
cp -v "$PROD"/lineage-*-UNOFFICIAL-sunfish.zip "$DEST/" 2>/dev/null || true
|
|
for f in vbmeta.img dtbo.img; do
|
|
[ -f "$PROD/$f" ] && cp -v "$PROD/$f" "$DEST/"
|
|
done
|
|
|
|
WLAN=$PROD/vendor/lib/modules/wlan.ko
|
|
if [ -f "$WLAN" ] && [ -f "$PROD/obj/KERNEL_OBJ/Module.symvers" ]; then
|
|
KCRC=$(awk '$2=="kmalloc_caches"{print $1; exit}' "$PROD/obj/KERNEL_OBJ/Module.symvers")
|
|
MCRC=$(/sbin/modprobe --dump-modversions "$WLAN" 2>/dev/null | awk '$2=="kmalloc_caches"{print $1; exit}')
|
|
echo "wlan kmalloc_caches kernel=$KCRC module=$MCRC"
|
|
fi
|
|
|
|
if strings "$DEST/boot.img" | grep -qiE 'KernelSU|CONFIG_KSU_SUSFS'; then
|
|
echo "FAIL: KernelSU in boot" >&2
|
|
exit 1
|
|
fi
|
|
|
|
{
|
|
echo "artifact=$DEST"
|
|
echo "list_clean=$LIST_CLEAN (429)"
|
|
echo "list_hi1=$LIST_HI1"
|
|
echo "list_hi2=$LIST_HI2"
|
|
echo "list_hi3=$LIST_HI3"
|
|
echo "hardening=Stage1+combo4+FORTIFY + CVE-clean + hi-batch1+2+3"
|
|
echo "cve_max_abs_offset_hi=9999"
|
|
echo "signing=test-keys"
|
|
echo "flash=fastboot flash boot; recover=hi-batch2 BOOT_OK"
|
|
date -u +"built=%Y-%m-%dT%H:%M:%SZ"
|
|
} | tee "$DEST/README.txt"
|
|
|
|
(cd "$DEST" && sha256sum boot.img boot-make.img lineage-*-UNOFFICIAL-sunfish.zip 2>/dev/null || true) \
|
|
| tee "$DEST/SHA256SUMS"
|
|
|
|
echo "=== DONE $DEST $(date -Is) ==="
|
|
# Force clean exit even if tee gets SIGPIPE on detach wrap
|
|
exit 0
|