sunfish-admin
12d2179c20
Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.
116 lines
4.7 KiB
Markdown
116 lines
4.7 KiB
Markdown
# Design: native call-recording unlock + FLAG_SECURE override (`008`/`009`)
|
|
|
|
**Date**: 2026-09-16
|
|
**Status**: Approved by owner (requirements); Spec Kit feature
|
|
`specs/008-call-rec-flag-secure/`
|
|
**LAB only**: `11231JEC207477`. No Magisk/LSPosed/Zygisk for these features.
|
|
|
|
## Problem
|
|
|
|
1. Lineage Dialer can refuse call recording based on **country / carrier**
|
|
rules even when the user wants to record.
|
|
2. Apps set `FLAG_SECURE` so screenshots / screen capture fail; we want an
|
|
optional **global** override (project-specific; not AXP Pro catalog).
|
|
|
|
## Goals (MVP)
|
|
|
|
Two **Developer Options** switches (same UX pattern as `005`
|
|
`allow_signature_fake`):
|
|
|
|
| Toggle (plain language) | Secure setting | Default | Effect when ON |
|
|
|-------------------------|----------------|---------|----------------|
|
|
| Disable call recording restrictions | `extendrom_call_recording` (GOLDEN / EXTENDROM) | `0` | Country/region limits ignored; Dialer may record |
|
|
| Allow screenshots of secure windows | `disable_secure_windows` (AOSP; DO pref `allow_flag_secure_override`) | `0` | Global: ignore `FLAG_SECURE` for screenshots / screen capture (debuggable builds) |
|
|
|
|
- **Global only** — product requirement; no per-app lists (not planned).
|
|
- OFF = stock Android / LOS behaviour.
|
|
- No root modules required at runtime.
|
|
|
|
## Non-goals
|
|
|
|
- Full AXP call-recording policy UI (auto-record rules, etc.).
|
|
- Per-app FLAG_SECURE lists (out of scope permanently for this project).
|
|
- Banking / KernelSU (`007` incomplete).
|
|
- Shipping Magisk zips.
|
|
|
|
## Approaches considered
|
|
|
|
### Call recording
|
|
|
|
| Approach | Pros | Cons |
|
|
|----------|------|------|
|
|
| **A. EXTENDROM / AXP GOLDEN native F_CALLREC** (chosen) | Same Secure key as GOLDEN (`extendrom_call_recording=1` observed); DO + Dialer gate; attributable | Re-validate paths on LOS 23.2 / A16 |
|
|
| B. Magisk Dialer RRO (`call_record_states.xml`) | Tiny | Not native; no GOLDEN parity; rejected |
|
|
| C. Blind-copy A11 overlays only | Fast | May no-op without Dialer Java gate |
|
|
|
|
**Choice: A.** Primary sources:
|
|
`/srv/rom/references/extendrom/er.sh` (F_CALLREC),
|
|
`overlays/call-rec`, `config/call-rec/…/CallRecPreferenceController.java`.
|
|
Secure string: `Settings.Secure.ER_ALLOW_ANY_CALL_REC = "extendrom_call_recording"`.
|
|
|
|
Also enable Dialer `call_recording_enabled` / audio source as needed for
|
|
sunfish (EXTENDROM sets `call_recording_enabled=true`,
|
|
`call_recording_audio_source=4`), after verifying LOS 23.2 Dialer still uses
|
|
those resources.
|
|
|
|
### FLAG_SECURE
|
|
|
|
| Approach | Pros | Cons |
|
|
|----------|------|------|
|
|
| **A. DO → AOSP `DISABLE_SECURE_WINDOWS`** (chosen) | Already in WMS on A16; tiny surface | Debuggable-only gate in stock WMS |
|
|
| B. Magisk `services.jar` patcher | Works on `user` | Not native ROM |
|
|
| C. Duplicate frameworks hooks under another Secure key | — | Redundant with AOSP |
|
|
|
|
**Choice: A.** Wire Settings DO to `disable_secure_windows`.
|
|
|
|
## Design
|
|
|
|
### Settings / UI
|
|
|
|
- Category under Developer Options (new or shared “Privacy overrides” /
|
|
EXTENDROM-style categories).
|
|
- Two `SwitchPreference`s + short legal/risk summaries (call recording:
|
|
user responsible for local law — EXTENDROM wording as reference).
|
|
- Controllers mirror `005` / EXTENDROM `DeveloperOptionsPreferenceController`:
|
|
write `Settings.Secure` 0/1; reset to 0 when Developer Options master is
|
|
disabled.
|
|
|
|
### Call recording path
|
|
|
|
1. Inventory LOS 23.2 Dialer: where country/carrier recording is blocked
|
|
(`isCountryAllowed` or successor).
|
|
2. When `extendrom_call_recording=1`, treat as allowed (GOLDEN).
|
|
3. Ensure recording feature is compiled/enabled for Dialer on sunfish
|
|
(`config.xml` / product overlay as required).
|
|
4. LAB: enable toggle → place/receive call → record → file exists; disable →
|
|
region block behaviour restored (or stock deny if in restricted region).
|
|
|
|
### FLAG_SECURE path
|
|
|
|
1. Confirmed A16: `WindowManagerService` + `WindowState.isSecureLocked()` already
|
|
honour `Settings.Secure.DISABLE_SECURE_WINDOWS`.
|
|
2. DO switch writes that key (UI title: Allow screenshots of secure windows).
|
|
3. LAB userdebug: OFF blocked / ON capturable; document DRM exceptions.
|
|
|
|
### Packaging
|
|
|
|
- Patches under `vendor/sunfish-a16/patches/008-…` (idempotent apply script
|
|
like `005-sigspoof`), attributed to EXTENDROM/`er.sh` F_CALLREC (call-rec)
|
|
and native frameworks work (FLAG_SECURE).
|
|
- No Magisk in the bacon zip; no Magisk zips in the meta-repo.
|
|
|
|
### Validation
|
|
|
|
- LAB serial only; document settings get/put and screenshots/logs under
|
|
`/srv/rom/artifacts/008-…`.
|
|
- Does not reopen `007` banking gates.
|
|
|
|
## Relationship to roadmap numbers
|
|
|
|
| Roadmap # | Theme | This feature |
|
|
|-----------|--------|--------------|
|
|
| 008 | Call recording | Included |
|
|
| 009 | FLAG_SECURE | Included (global only) |
|
|
|
|
Single Spec Kit directory: `specs/008-call-rec-flag-secure/`.
|