0 Fork 0

Files

T

sunfish-admin 12d2179c20 AXP Magisk resurrection track: Speckit 009 port AXP/LOS22 to LOS23.

Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.

2026-09-16 21:56:22 +00:00

2.6 KiB

Raw Blame History

Runbook: `008` call-rec + FLAG_SECURE (LAB)

LAB serial: 11231JEC207477 only — never GOLDEN.
Apply (on rom-dev01):

python3 /srv/rom/src/lineage/vendor/sunfish-a16/patches/008-call-rec-flag-secure/apply_008_call_rec_flag_secure.py

Idempotent (second run = all “already”). Marker: SUNFISH_A16_008_CALL_REC_FLAG_SECURE.

Evidence: /srv/rom/artifacts/008-call-rec-flag-secure/
Logs: /srv/rom/logs/008-build/
Backups: /srv/rom/artifacts/008-call-rec-flag-secure/bak-snapshots/

Secure keys

Key	Default	Source
`extendrom_call_recording`	`0`	AXP GOLDEN / EXTENDROM (`ER_ALLOW_ANY_CALL_REC`)
`disable_secure_windows`	`0`	AOSP A16 `Settings.Secure.DISABLE_SECURE_WINDOWS` (DO UI key `allow_flag_secure_override`)

GOLDEN dump: extendrom_call_recording=1 in .local-artifacts/002-golden/…/settings/secure-*.txt.

Call-rec — EXTENDROM `F_CALLREC` (applied)

Step	LOS 23.2 path	Status
Dialer config	`packages/apps/Dialer/.../callrecord/res/values/config.xml`	already `enabled=true`, audio `4`
Controllers	`Settings/.../ER_CallRecPreferenceController.java` + `ER_CallRecInfo.java`	applied
Dashboard	`DevelopmentSettingsDashboardFragment.java`	applied
DO XML	`Settings/res/xml/development_settings.xml`	applied
Strings	`Settings/res/values/strings.xml`	applied
Secure const	`frameworks/base/.../Settings.java` `ER_ALLOW_ANY_CALL_REC`	applied
Dialer gate	`Dialer/.../CallRecorder.java` `canRecordInCurrentCountry`	applied

FLAG_SECURE — A16 inventory (applied via DO only)

AOSP already implements the capture path:

WindowState.isSecureLocked() → early false if mWmService.getDisableSecureWindows()
WindowManagerService.updateDisableSecureWindows() reads Settings.Secure.DISABLE_SECURE_WINDOWS
Only when ro.debuggable / SYSTEM_DEBUGGABLE is true (LAB userdebug OK; user needs retest / possible gate lift later)

Project work: Settings DO writes that Secure key (no Magisk / no jar patcher).

Validation

See specs/008-call-rec-flag-secure/quickstart.md.

After bacon + flash Magisk-free:

adb -s 11231JEC207477 shell settings get secure extendrom_call_recording
adb -s 11231JEC207477 shell settings get secure disable_secure_windows

`user` vs `userdebug`

LAB = userdebug (DO + WMS secure-windows disable active). Before release (011), re-check on user: DO visibility (like 005) and whether updateDisableSecureWindows still no-ops when not debuggable — document outcome; do not silently claim user PASS.

2.6 KiB Raw Blame History

Runbook: 008 call-rec + FLAG_SECURE (LAB)