AXP-Resurection/vendor/sunfish-a16/patches/009-kernel-hardening/README.md

009 kernel hardening Stage 1 (FR-017)

Source: AXP kernel_patches @ df3cab2155b3 (GrapheneOS / AndroidHardening series in Divest-era layout).
Base: LOS kernel/google/msm-4.14 @ 28f9290ae067 (4.14.357-openela).
Map: docs/009-kernel-hardening-map.md.

Files

File	Role
stage1.list	Ordered allowlist (30 patches)
apply_stage1.sh	Applies list onto a kernel tree

Host usage (rom-dev01)

# dry-run
bash vendor/sunfish-a16/patches/009-kernel-hardening/apply_stage1.sh \
  /srv/rom/src/lineage/kernel/google/msm-4.14 --dry-run

# apply (dirties the lineage kernel checkout)
bash vendor/sunfish-a16/patches/009-kernel-hardening/apply_stage1.sh \
  /srv/rom/src/lineage/kernel/google/msm-4.14

Optional: AXP_KERNEL_PATCHES=/path/to/kernel_patches.

After apply, flip sunfish_defconfig options that the new Kconfig allows (at least CONFIG_FORTIFY_SOURCE=y); see map KH-CFG.

Boot-OK pack (2026-09-28 LAB) — prefer for Magisk bacon

Stage1 Graphene alone historically hung at the Google logo on LOS23/Clang. The pack that boots with Magisk-track boot-make is combo4 + Clang FORTIFY (no Stage1 mega-pack):

# on a reset msm-4.14 @ 28f9290ae067:
bash vendor/sunfish-a16/patches/009-kernel-hardening/apply_combo4_fortify.sh \
  /path/to/msm-4.14

That applies fortify-clang/ (incl. nested __underlying_strlen fix) + driver bounds + defconfig: FORTIFY_SOURCE, INIT_ON_*, SECURITY_DMESG_RESTRICT, SLAB_FREELIST_HARDENED. Bacon entrypoint: scripts/009-bacon-axp-combo4-fortify.sh.

Stage1 + combo4 (full bacon, Wi‑Fi coherent)

# reset msm-4.14 @ 28f9290ae067, then:
bash vendor/sunfish-a16/patches/009-kernel-hardening/apply_stage1_combo4.sh \
  /path/to/msm-4.14
# bacon: scripts/009-bacon-axp-stage1-combo4.sh

Order: Stage1 (30) → slab BUILD-FIXES if needed → combo4+FORTIFY. Ship via sideload of the zip (matching vendor/wlan.ko). Do not flash only the new boot onto an old slot.

LAB accepted 2026-09-29: see docs/009-gate-g-kernel-attribution.md.

GPS / location (FR-018 — do not regress)

Owner wants precise, fast GPS (stock LOS behaviour). Never apply AXP location lockdown, SUPL/IMSI stripping that hurts TTFF, or extra location caps vs LOS 23.2. Stage1 list, cve-strict.list, and denylist must stay free of location-lockdown series (KH-LOC = skip). If a future CVE hunk touches GNSS/GPS paths only for a real security fix, keep LOS-equivalent behaviour and document; do not “harden location” as a side goal.

Not in Stage 1 alone

• CVE mega — now staged via apply_stage1_combo4_cve.sh + cve-strict.list (~503 AXP allowlist from 2026-09-18 strict pass; cve-denylist.txt skipped). Bacon: scripts/009-bacon-axp-stage1-combo4-cve.sh (test-keys; after boot-OK Stage1 pack). Do not flash 20260918*-axp-kh-cve/full.
• LinuxIncrementals
• Failed probe patches (port later)
• Location lockdown (FR-018)
• Iodé kernel (no sunfish 4.14 fork found)