Files
AXP-Resurection/vendor/sunfish-a16/patches/009-axp-los23-port/hardening
sunfish-adminandCursor 2d145c2878 009: Polish bacon fixes, OTA host scripts, and migration docs.
Restore disable_configstore, EuiccDisabler and thermal CDEV guards, branding
and rebuild/sync helpers; document device roles, laptop migration, and Gitea.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-16 21:06:45 +02:00
..

US-S4-1 — drop Lineage product OpenSSH binaries / rsync / procmem

Track: AXP Resurection Pro (Magisk), unlocked sunfish.
Not: slim variant; not bootloader lock; not Yama (kernel).

AXP reference (mandatory)

Oracle: AXP.OS-22.2-20260324-PRO-sunfish.zip → payload.bin → product.img (+ GOLDEN ro.lineage.version=22.2-2026.003-sunfish-pro, Android 15):

Path AXP PRO (A15)
/bin/sshd, ssh, scp, sftp, ssh-keygen, start-ssh absent
/bin/rsync, /bin/procmem absent
/etc/init/init.openssh.rc present (mkdir /data/ssh*)

Was this an A16 Lineage add?

No. Lineage vendor/lineage/config/common.mk has shipped the Openssh block since 2012; lineage-20 / 21 / 22.2 all still include it. AXP PRO on A15 therefore actively omitted the binaries (same lineage generation still lists them upstream). Public AXP.OS/android_vendor_lineage upstream_* mirrors keep the Lineage Openssh block — use the PRO zip / GOLDEN, not that mirror, as product oracle.

What we ship

Match AXP PRO product surface by stripping Lineage common.mk package adds (see apply_009_drop_openssh_packages.py) — a plain PRODUCT_PACKAGES := $(filter-out …) inherit did not drop sshd from ship 20261002T125259Z:

  • Remove packages: scp, sftp, ssh, sshd, sshd_config, ssh-keygen, start-ssh, rsync, procmem (debug)
  • Keep init.openssh.rc copy (AXP has it)

Remote shell / file transfer on this track remains adb (+ Magisk); the rc only creates /data/ssh* and does not start sshd without the binary.

Verify (LAB after flash)

adb shell ls /product/bin/sshd                    # expect: No such file
adb shell ls /product/bin/rsync                   # expect: No such file
adb shell ls /product/etc/init/init.openssh.rc    # expect: present (AXP)
adb shell pidof magiskd                           # expect: non-empty

US-S4-2 — drop Jelly + Gallery2 (AXP PRO product)

Oracle: same PRO zip — product/app has no Jelly / Gallery2; system_ext ships Fossify + noDefaultBrowserWebView. Inventory: docs/009-axp-pro-product-apps-20260324.md.

  • apply_009_drop_jelly_gallery2.py — remove Lineage PRODUCT_PACKAGES adds for Jelly / Gallery2
  • NoLineageJelly uninstallable override module (AXP stub class)
  • Keep FossifyGallery (already overrides Gallery/Gallery2/Glimpse)

LAB after flash: no /product/app/Jelly, no /product/app/Gallery2, FossifyGallery present.

Out of scope

  • CONFIG_SECURITY_YAMA (kernel / US-S5 — unset like GOLDEN since 2026-10-10; scope 2 broke PairIP)
  • Switching lunch to user (US-S6)
  • NeoLauncher / Aosmium (wont / exception)