sunfish-admin
deaaf42caa
Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding, bundled apps, and AXP-class product surface docs/scripts.
165 lines
6.2 KiB
Bash
165 lines
6.2 KiB
Bash
#!/bin/bash
|
||
# 009 bacon — Stage1 + combo4+FORTIFY + CVE-strict (AXP cve_checker allowlist).
|
||
# Intentionally test-keys (isolate CVE vs signing). Flash only after LAB boot/Wi‑Fi.
|
||
# Do NOT flash old 20260918 *-axp-kh-cve/full (pre-FORTIFY hang).
|
||
set -e
|
||
cd /srv/rom/src/lineage
|
||
export HOME=/home/android-build
|
||
export CCACHE_DIR=/srv/rom/ccache
|
||
export USE_CCACHE=1
|
||
export PATH=/home/android-build/bin:/usr/local/bin:/usr/bin:/bin:$PATH
|
||
export ANDROID_BUILD_TOP=/srv/rom/src/lineage
|
||
unset OUT_DIR || true
|
||
export SUNFISH_A16_MAGISK_PREROOT=1
|
||
export MAGISK_APK=/srv/rom/prebuilts/magisk/Magisk-v30.7.apk
|
||
# Isolate: no release keys on this CVE iteration
|
||
unset PRODUCT_DEFAULT_DEV_CERTIFICATE || true
|
||
|
||
LOGDIR=/srv/rom/logs/009-build
|
||
mkdir -p "$LOGDIR"
|
||
LOG=$LOGDIR/bacon-axp-stage1-combo4-cve.log
|
||
exec > >(tee -a "$LOG") 2>&1
|
||
|
||
echo "=== START 009-bacon-axp-stage1-combo4-cve $(date -Is) ==="
|
||
|
||
LIVE=kernel/google/msm-4.14
|
||
BASE=28f9290ae067
|
||
test -d "$LIVE"
|
||
|
||
echo "=== reset kernel @ $BASE ==="
|
||
git -C "$LIVE" reset --hard "$BASE"
|
||
git -C "$LIVE" clean -fdq
|
||
|
||
KH=vendor/sunfish-a16/patches/009-kernel-hardening
|
||
chmod +x "$KH"/apply_stage1_combo4.sh "$KH"/apply_cve_strict.sh \
|
||
"$KH"/apply_stage1_combo4_cve.sh "$KH"/apply_stage1.sh \
|
||
"$KH"/apply_combo4_fortify.sh 2>/dev/null || true
|
||
bash "$KH/apply_stage1_combo4_cve.sh" "$LIVE"
|
||
|
||
DEF=$LIVE/arch/arm64/configs/sunfish_defconfig
|
||
if grep -qE "^CONFIG_KSU.*=y" "$DEF"; then
|
||
echo "FAIL: $DEF still enables KernelSU" >&2
|
||
exit 1
|
||
fi
|
||
for k in FORTIFY_SOURCE INIT_ON_ALLOC_DEFAULT_ON INIT_ON_FREE_DEFAULT_ON \
|
||
SECURITY_DMESG_RESTRICT SLAB_FREELIST_HARDENED; do
|
||
if ! grep -q "^CONFIG_${k}=y" "$DEF"; then
|
||
echo "FAIL: missing CONFIG_${k}=y" >&2
|
||
exit 1
|
||
fi
|
||
done
|
||
grep -q "ret = __underlying_strlen(q);" "$LIVE/include/linux/string.h"
|
||
echo "OK: Stage1 + combo4+FORTIFY + CVE markers present"
|
||
|
||
rm -f out/target/product/sunfish/obj/KERNEL_OBJ/arch/arm64/boot/Image.lz4 \
|
||
out/target/product/sunfish/obj/KERNEL_OBJ/arch/arm64/boot/Image \
|
||
out/target/product/sunfish/kernel
|
||
echo "OK: cleared prior Image for kernel rebuild"
|
||
|
||
python3 vendor/sunfish-a16/patches/008-call-rec-flag-secure/apply_wms_disable_secure_debuggable_gate.py
|
||
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_disable_user_apps.py
|
||
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_private_dns_providers.py
|
||
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_connectivity_check.py
|
||
|
||
PH=/srv/rom/src/lineage/vendor/sunfish-a16/prebuilt/Phonesky.apk
|
||
test -e "$PH"
|
||
AAPT=/srv/rom/src/lineage/prebuilts/sdk/tools/linux/bin/aapt
|
||
if ! "$AAPT" dump permissions "$PH" 2>/dev/null | grep -q USE_EXACT_ALARM; then
|
||
echo "FAIL: Phonesky missing USE_EXACT_ALARM" >&2
|
||
exit 1
|
||
fi
|
||
echo "OK: Phonesky has USE_EXACT_ALARM"
|
||
|
||
MAGISK_STAGE_DIR=/srv/rom/src/lineage/out/.magisk \
|
||
vendor/sunfish-a16/magisk/prepare_magisk.sh
|
||
python3 vendor/sunfish-a16/magisk/apply_releasetools_hook.py --top "$ANDROID_BUILD_TOP" --force
|
||
test -f out/.magisk/READY
|
||
|
||
rm -rf out/soong/.intermediates/build/make/tools/releasetools/releasetools_common
|
||
rm -rf out/soong/.intermediates/build/make/tools/releasetools/add_img_to_target_files
|
||
rm -rf out/target/product/sunfish/obj/PACKAGING/target_files_intermediates
|
||
rm -f out/target/product/sunfish/lineage-*.zip \
|
||
out/target/product/sunfish/boot.img \
|
||
out/target/product/sunfish/system/priv-app/Phonesky/Phonesky.apk
|
||
touch frameworks/base/services/core/java/com/android/server/wm/WindowManagerService.java
|
||
|
||
set +u
|
||
# shellcheck disable=SC1091
|
||
source build/envsetup.sh
|
||
set -e
|
||
# Force test-keys for this CVE pack (signing is a later stage)
|
||
unset PRODUCT_DEFAULT_DEV_CERTIFICATE || true
|
||
echo "OK: signing=test-keys (CVE isolation)"
|
||
|
||
breakfast sunfish userdebug
|
||
test "${TARGET_RELEASE:-}" = "bp4a"
|
||
|
||
echo "=== mka bacon $(date -Is) ==="
|
||
set -o pipefail
|
||
mka bacon -j8
|
||
ec=${PIPESTATUS[0]}
|
||
echo "bacon_exit=$ec $(date -Is)"
|
||
[ "$ec" -eq 0 ] || exit "$ec"
|
||
|
||
PROD=out/target/product/sunfish
|
||
BID=$(date -u +%Y%m%dT%H%M%SZ)
|
||
DEST=/srv/rom/artifacts/009-axp-los23-port/${BID}-axp-stage1-combo4-cve
|
||
mkdir -p "$DEST"
|
||
|
||
TF_BOOT=$(find "$PROD/obj/PACKAGING/target_files_intermediates" -path "*/IMAGES/boot.img" 2>/dev/null | head -1)
|
||
MAKE_BOOT=$PROD/boot.img
|
||
if [ -n "${TF_BOOT:-}" ] && [ -f "$TF_BOOT" ]; then
|
||
cp -v "$TF_BOOT" "$DEST/boot.img"
|
||
cp -v "$MAKE_BOOT" "$DEST/boot-make.img" 2>/dev/null || true
|
||
echo "boot_source=target_files_IMAGES"
|
||
else
|
||
cp -v "$MAKE_BOOT" "$DEST/boot.img"
|
||
echo "WARN: no TF IMAGES/boot.img — using Make boot"
|
||
fi
|
||
|
||
cp -v "$PROD"/lineage-*-UNOFFICIAL-sunfish.zip "$DEST/" 2>/dev/null || true
|
||
for f in vbmeta.img dtbo.img; do
|
||
[ -f "$PROD/$f" ] && cp -v "$PROD/$f" "$DEST/"
|
||
done
|
||
|
||
WLAN=$PROD/vendor/lib/modules/wlan.ko
|
||
if [ -f "$WLAN" ] && [ -f "$PROD/obj/KERNEL_OBJ/Module.symvers" ]; then
|
||
KCRC=$(awk '$2=="kmalloc_caches"{print $1; exit}' "$PROD/obj/KERNEL_OBJ/Module.symvers")
|
||
MCRC=$(/sbin/modprobe --dump-modversions "$WLAN" 2>/dev/null | awk '$2=="kmalloc_caches"{print $1; exit}')
|
||
echo "wlan kmalloc_caches kernel=$KCRC module=$MCRC"
|
||
if [ -n "$KCRC" ] && [ -n "$MCRC" ] && [ "$KCRC" = "$MCRC" ]; then
|
||
echo "OK: wlan.ko CRC matches kernel (Wi-Fi pack coherent)"
|
||
else
|
||
echo "WARN: wlan.ko CRC mismatch or unreadable — check before flash"
|
||
fi
|
||
fi
|
||
|
||
MB=out/.magisk/magiskboot
|
||
if [ -x "$MB" ]; then
|
||
rm -rf "$DEST/boot-check" && mkdir -p "$DEST/boot-check"
|
||
if ! "$MB" unpack "$DEST/boot.img" "$DEST/boot-check" >/dev/null 2>&1; then
|
||
echo "WARN: magiskboot unpack failed (host SIGILL flake possible)"
|
||
fi
|
||
fi
|
||
if strings "$DEST/boot.img" | grep -qiE 'KernelSU|CONFIG_KSU_SUSFS'; then
|
||
echo "FAIL: KernelSU strings in boot.img" >&2
|
||
exit 1
|
||
fi
|
||
echo "OK: no KernelSU strings in boot.img"
|
||
|
||
{
|
||
echo "artifact=$DEST"
|
||
echo "kernel_base=$BASE"
|
||
echo "hardening=Stage1 + combo4+clang-fortify + CVE-strict (~503 AXP allowlist, denylist skipped)"
|
||
echo "magisk=preroot EXTENDROM-class v30.7"
|
||
echo "signing=test-keys (CVE isolation; release-keys later)"
|
||
echo "flash=recovery wipe + sideload zip + reboot system"
|
||
echo "note=do not flash 20260918 kh-cve/kh-full (pre-FORTIFY hang)"
|
||
date -u +"built=%Y-%m-%dT%H:%M:%SZ"
|
||
} | tee "$DEST/README.txt"
|
||
|
||
(cd "$DEST" && sha256sum boot.img boot-make.img lineage-*-UNOFFICIAL-sunfish.zip 2>/dev/null || true) \
|
||
| tee "$DEST/SHA256SUMS"
|
||
|
||
echo "=== DONE $DEST $(date -Is) ==="
|