sunfish-admin
deaaf42caa
Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding, bundled apps, and AXP-class product surface docs/scripts.
52 lines
1.4 KiB
Bash
Executable File
52 lines
1.4 KiB
Bash
Executable File
#!/bin/bash
|
|
# Apply the LAB-verified combo4 + Clang FORTIFY pack onto a clean msm-4.14 tree.
|
|
#
|
|
# Boot-OK on sunfish LAB 2026-09-28 (ksync combo4-fortify-fix). This is NOT
|
|
# the full Graphene Stage1 pack (Stage1 alone historically hung at Google logo).
|
|
#
|
|
# Usage: apply_combo4_fortify.sh <kernel-tree>
|
|
# Expects a virgin / reset tree (apply_fortify_clang.py is not idempotent).
|
|
set -e
|
|
|
|
K=${1:?kernel tree}
|
|
HERE=$(cd "$(dirname "$0")" && pwd)
|
|
FC="$HERE/fortify-clang"
|
|
|
|
test -d "$K/include/linux"
|
|
test -f "$FC/apply_fortify_clang.py"
|
|
test -f "$FC/0001-driver-bounds-rtac-fils.patch"
|
|
|
|
python3 "$FC/apply_fortify_clang.py" "$K"
|
|
patch -p1 --forward --batch -d "$K" < "$FC/0001-driver-bounds-rtac-fils.patch"
|
|
|
|
DEF="$K/arch/arm64/configs/sunfish_defconfig"
|
|
test -f "$DEF"
|
|
|
|
# Drop any prior toggles we manage, then enable the boot-OK set.
|
|
for k in \
|
|
FORTIFY_SOURCE \
|
|
INIT_ON_ALLOC_DEFAULT_ON \
|
|
INIT_ON_FREE_DEFAULT_ON \
|
|
SECURITY_DMESG_RESTRICT \
|
|
SLAB_FREELIST_HARDENED \
|
|
SLAB_HARDENED
|
|
do
|
|
sed -i "/CONFIG_${k}/d" "$DEF"
|
|
done
|
|
|
|
# Keep KernelSU off on this Magisk track.
|
|
sed -i '/CONFIG_KSU/d' "$DEF"
|
|
echo '# CONFIG_KSU is not set' >> "$DEF"
|
|
|
|
for k in \
|
|
CONFIG_FORTIFY_SOURCE \
|
|
CONFIG_INIT_ON_ALLOC_DEFAULT_ON \
|
|
CONFIG_INIT_ON_FREE_DEFAULT_ON \
|
|
CONFIG_SECURITY_DMESG_RESTRICT \
|
|
CONFIG_SLAB_FREELIST_HARDENED
|
|
do
|
|
echo "${k}=y" >> "$DEF"
|
|
done
|
|
|
|
echo "OK: combo4+FORTIFY applied on $K"
|