sunfish-adminandCursor
2d145c2878
Restore disable_configstore, EuiccDisabler and thermal CDEV guards, branding and rebuild/sync helpers; document device roles, laptop migration, and Gitea. Co-authored-by: Cursor <cursoragent@cursor.com>
21 KiB
AXP Resurrection Pro — Pixel 4a (sunfish)
LineageOS 23.2 · Android 16 · Privacy-oriented custom ROM
AXP Resurrection Pro (AXPR) brings the AXP.OS Pro experience forward onto LineageOS 23.2 for the Google Pixel 4a. It is aimed at users who want a maintained Android 16 base, microG instead of proprietary Google Play services, optional root via Magisk, and extra kernel and system hardening drawn from established community sources (including GrapheneOS-class kernel work), without tying you to deprecated AXP update servers.
This document describes what the ROM contains. It is written for end users and reviewers, not for build infrastructure.
Current generation (example build id): 23.2-20261008 · BP4A.251205.006
· release-keys
1. At a glance
| Topic | What you get |
|---|---|
| Base | LineageOS 23.2, Android 16, Pixel 4a only |
| Google services | microG + GSF proxy; no built-in Google account requirement |
| Play Store | Play Store (Phonesky) build patched for this project (exact-alarm and related fixes) |
| Root | Magisk embedded at build time; you activate from the Magisk app after flash |
| Privacy apps | Aurora Store, Droidify, Fossify Gallery, Jelly browser, OpenEUICC |
| Hardening | Kernel patches (Graphene-derived + CVE backports), hardened_malloc, trimmed system surface |
| Updates | Full ROM via recovery sideload; individual system apps can be updated in place when signed compatibly |
| Bootloader | Unlocked workflow (orange state); not designed for relocked retail boot |
2. Everything added on top of LineageOS 23.2
Stock LineageOS 23.2 for sunfish is a clean AOSP-derived system: no microG, no Play Store, no Magisk, test-keys or UNOFFICIAL builds in typical user trees, default Private DNS list, default connectivity check (Google), Gallery2 or Glimpse, full Lineage tool bundle on system, Google carrier/eUICC apps from vendor makefiles, and the upstream 4.14 kernel without the AXP/Graphene CVE and hardening layers below.
AXP Resurrection Pro keeps the Lineage base (Launcher3, Dialer, updaters, device support) and layers the following.
2.1 Product identity and visuals
| Change | LineageOS default | AXPR |
|---|---|---|
| Build channel | Often UNOFFICIAL / nightly naming | PRO product (…-PRO-sunfish) |
| Signing | Test-keys on many community builds | release-keys (project keys) |
| Manufacturer / brand props | Lineage | AXP Resurrection system branding |
| Setup welcome | Lineage wording | “Welcome to AXP Resurrection” |
| Boot animation | Narrow band layout | Full-screen 1080×2340 animation |
| OTA zip name | lineage-*.zip |
Matching AXP-Resurrection-Pro-*.zip (same payload) |
2.2 Google replacement stack (not in vanilla LOS)
| Component | Purpose |
|---|---|
| microG Services (GmsCore) | Open-source reimplementation of Play Services |
| GSF Proxy | Framework stub for apps expecting Google Services Framework |
| Play Store (Phonesky) | Play client build maintained for this ROM (exact-alarm and related fixes) |
| GmsCore native libraries | ARM64 JNI libs shipped inside the image (required for Maps / TLS stacks) |
Vanilla Lineage does not ship these; you would install microG yourself on a separate track.
2.3 Extra applications (vs typical LOS sunfish)
| App | Notes |
|---|---|
| Aurora Store | Play store front-end |
| Droidify | F-Droid client (instead of shipping classic F-Droid) |
| Fossify Gallery | Replaces Gallery2 / Glimpse on this product |
| Jelly | Lightweight browser added on product (Lineage 23 does not include Jelly in the default sunfish product set) |
| OpenEUICC | Privileged eSIM manager where Google EUICC is removed |
| Magisk | Preroot boot integration + manager (see §5 Root and Magisk) |
Unchanged vs LOS intent: Launcher3 (no NeoLauncher), standard Lineage core apps, Lineage WebView as default provider.
2.4 Settings and framework behaviour (AXP / GrapheneOS / Calyx class)
These are code changes in the platform, not separate APKs.
Privacy and network
| Feature | What Lineage does | What AXPR adds |
|---|---|---|
| Private DNS presets | Small default set | 15+ named providers (AdGuard, Mullvad, Quad9, Cloudflare, regional DoT hosts, etc.) |
| Internet connectivity check | Fixed Google-style check | User-selectable provider (Disabled, Amazon, Cloudflare, Google, Huawei, Kuketz, Microsoft, openSUSE, Ubuntu, …) — no AXP-owned servers |
| Force disable SUPL | Not exposed | Settings toggle; forces SUPL off for stricter GNSS |
| Stop extra location assistance | Not exposed | Toggle to stop extra Qualcomm / XTRA-style assistance when disabled |
| Kernel command line privacy | /proc/cmdline often world-readable |
Mode 0440 on /proc/cmdline for unprivileged apps (GOLDEN/AXP class) |
Security, biometrics, and media metadata
| Feature | What Lineage does | What AXPR adds |
|---|---|---|
| Fingerprint permanent lockout | Higher failed-attempt threshold | Stricter lockout (AXP constant: fewer attempts before permanent lockout) |
| Build serial exposure | Legacy paths may expose serial via deprecated APIs | Build.SERIAL stays unknown; real serial only via Build.getSerial() + permission |
| Screenshot EXIF | OS name, time, unique id in metadata | Minimal EXIF (width/height only — Calyx/AXP class) |
| Recovery OTA metadata | Can accept packages restricted to device serial | Rejects update packages that carry a serialno= constraint |
| Signature spoofing | microG base only | Developer option allow_signature_fake (default off) for microG / compatible apps |
| Call recording | Region/carrier gated | Developer option extendrom_call_recording unlocks recording path in Dialer where supported |
| FLAG_SECURE / screen capture | Apps can block capture | Optional disable_secure_windows (default off), works on user builds without ro.debuggable=1 |
| Disable app | Android 16 emphasises Archive; disable hidden for many user apps | Disable restored for user-installed apps in Settings |
| Native debug | Standard ptrace policy | persist.native_debug — when enabled, relaxes ptrace scope for debugging (default off) |
Timeouts and System UI
| Feature | What Lineage does | What AXPR adds |
|---|---|---|
| Automatic reboot | Not in stock LOS Settings | Idle auto-reboot (Security settings) |
| Bluetooth timeout | Manual only | Turns Bluetooth off after configurable inactivity |
| Wi‑Fi timeout | Manual only | Turns Wi‑Fi off after configurable inactivity |
| Quick Settings tiles | Usable from lock screen per tile | Sensitive tiles require unlock first (GrapheneOS SystemUI patch) |
| Keyguard / reboot | Standard | SystemUI / SystemServer hooks for timeout and reboot integration (AXP server extensions) |
2.5 Packages and binaries removed (vs Lineage sunfish)
Selective deblob, not a generic “remove all Google” script.
Wave 1 — Google eUICC LPA
| Removed | Replaced by |
|---|---|
| EuiccGoogle, EuiccGoogleOverlay | OpenEUICC (EuiccSupportPixel support packages kept) |
Wave 2 — Carrier / RCS Google & AOSP entitlement
| Removed (examples) | Kept for radio |
|---|---|
| CarrierServices, CarrierSettings, CarrierWifi, CarrierSetup, RilConfigService, grilservice | ims, QtiTelephonyService, Qualcomm daemons, Dialer, GoogleParts |
| PresencePolling, RcsService (device makefile) | |
| ImsServiceEntitlement (telephony product) |
Wave 3 — Lineage maintenance tools on system
| Removed from system / system_ext | Still on AXPR (AXP parity) |
|---|---|
| bash, htop, nano, unrar, addon.d/50-lineage.sh | curl, vim, zstd, recovery nano |
Wave 4 — Debug / diag surface
| Removed | Explicitly kept |
|---|---|
| Qualcomm diag_* tools, test_diag, imsrcsd | loc_launcher, lowi-server, xtra-daemon, IMS RTP/data daemons, cnss-daemon; keep Lineage disable_configstore (overrides HIDL configstore HAL — required on A16 VINTF) |
| Some AOSP debug host tools on device where safe | bpftool, alloctop, apexd-lsof remain in build where the OS requires them |
Product OpenSSH (US-S4-1)
| Removed | Kept |
|---|---|
| ssh, sshd, scp, sftp, rsync, procmem on product | init.openssh.rc stub only (no sshd binary) — remote admin via adb / Magisk |
2.6 Kernel, allocator, and CVEs (summary)
On top of the same msm-4.14 tree Lineage ships:
- 30 GrapheneOS-derived kernel patches (Deny USB, allocsize, fortify, slab, sanitize, ro_after_init, randomisation, …) — see §8 below.
- Extra Kconfig: FORTIFY, init-on-alloc/free, dmesg restrict, slab hardened, SLAB_FREELIST_RANDOM; no Yama (app compatibility).
- 449 documented CVE backport identifiers + companion fixes (e.g. USB lock-scope instead of raw CVE-2022-49980 one-liner).
- hardened_malloc in bionic for 64-bit processes (with graphics/camera exclusions).
Lineage’s existing hardening (CFI, shadow stack, KASLR, PAN, …) is retained.
2.7 Intentionally not changed vs Lineage
- No GrapheneOS-style location lockdown kernel (GPS behaviour stays LOS-like).
- No Aosmium / proprietary AXP WebView baked in.
- No AXP online OTA or external market repositories.
- No KernelSU in the standard product.
- No bundled Play Integrity / banking Magisk modules.
- Device tree / modem firmware line unchanged (Pixel 4a vendor blobs).
3. Who this ROM is for
- You use microG and install apps via Aurora / Droidify / Play as you choose.
- You want AXP-style settings (private DNS presets, connectivity controls, classic Disable app, timeouts, optional signature spoofing and call-recording unlock) on a current Lineage tree.
- You accept custom ROM risks: unlocked bootloader, community maintenance, no warranty.
Not goals of this ROM: banking attestation guarantees, locked bootloader, proprietary AXP OTA infrastructure, or shipping every Google / carrier app from stock Pixel firmware.
4. Preinstalled applications
| App | Role |
|---|---|
| microG Services (GmsCore) | Replaces Google Play Services for many apps |
| GSF Proxy | Google Services Framework compatibility layer |
| Play Store (Phonesky) | Google Play client (project-maintained APK) |
| Aurora Store | Alternative store front-end for Play |
| Droidify | Lightweight F-Droid client |
| Fossify Gallery | Gallery (replaces Lineage Gallery2 / Glimpse on this product) |
| Jelly | Small browser on the product partition |
| OpenEUICC | eSIM / EUICC management (replaces Google EUICC where removed) |
| Magisk | Root manager (stub until you complete first-time setup) |
| LineageOS core | Launcher3, Dialer, Messaging, etc. |
WebView: default is Lineage / AOSP WebView. You may install another WebView provider and select it under Developer options → WebView implementation (Aosmium and other legacy AXP WebViews are not shipped as default).
5. Root and Magisk
- Magisk is integrated into the boot image at ROM build time (AXP / EXTENDROM style preroot), not as a normal preinstalled Play-style system app only.
- After flashing, open Magisk once and allow it to download and install the current manager APK if prompted.
- Do not use “Install to inactive slot” or repeated boot repatching unless you know you need it: the boot image is already prepared. Extra patching often confuses the app and can break A/B slots.
- The home screen line “Ramdisk: Yes/No” describes how Magisk would install on a stock device; on preroot builds it may read No even when root works. Check Magisk version and whether apps can request superuser.
- Zygisk, DenyList, and modules are your choice after activation; the ROM does not ship banking or Play Integrity fix modules.
KernelSU is not part of this product line.
6. Settings and toggles (reference)
Same features as §2.4; quick lookup by menu area.
These appear in Settings / Developer options (exact menus follow AOSP Lineage layout). Names may be localized.
6.1 Privacy and network
| Feature | What it does |
|---|---|
| Private DNS providers | Extended preset list (AdGuard, Mullvad, Quad9, Cloudflare, Google DoT, regional providers, etc.) in addition to Lineage defaults |
| Internet connectivity check | Configurable connectivity validation (AXP-style behaviour; no dependency on AXP-owned servers) |
| Force disable SUPL | When enabled, disables SUPL-assisted GNSS (stricter location privacy) |
| Stop extra location assistance | When enabled, reduces extra Qualcomm / XTRA-style assistance daemons |
6.2 Security and developer
| Feature | What it does |
|---|---|
| Signature spoofing | Developer option to allow microG / selected apps to spoof signatures (restricted API) |
| Call recording unlock | Toggle to allow call recording where supported (AXP / EXTENDROM class) |
| FLAG_SECURE override | Optional global override for screen capture blocking (default off) |
| Native debug / ptrace | persist.native_debug — when enabled, relaxes ptrace scope for debugging (default off) |
| Disable app | Classic disable for user apps restored alongside Android’s archive behaviour |
6.3 Timeouts (Security / connected devices)
| Feature | What it does |
|---|---|
| Automatic reboot | Reboot after configurable idle time |
| Bluetooth timeout | Turn off Bluetooth after inactivity |
| Wi‑Fi timeout | Turn off Wi‑Fi after inactivity |
6.4 Branding
- Build type: Lineage PRO channel naming (
AXP Resurrection Proproduct) - Release keys (not
test-keys) on shipped builds
7. System surface changes (deblob summary)
Full package-level detail is in §2.5. Short overview:
AXP Resurrection Pro selectively removes components that AXP Pro omitted or that are unnecessary on a microG device. This is not a blind “remove everything Google” script.
Typical removals (by category):
| Category | Examples of what is removed or not shipped |
|---|---|
| Google EUICC / LPA | Google’s eUICC app (OpenEUICC replaces user-facing LPA) |
| Carrier / RCS Google | Selected Google carrier and RCS packages not needed for microG |
| Lineage maintenance tools on device | Interactive shells and convenience packages on system that AXP Pro did not ship (e.g. bash, htop, nano, unrar, Lineage addon.d helper) |
| Lab / debug commands | Further debug-only binaries trimmed in the full “wave 4” product |
Retained (examples): IMS, telephony services, Wi‑Fi / cellular stack,
Widevine, camera, Qualcomm services required for daily use, curl / vim where
AXP Pro kept them.
Product partition: OpenSSH binaries are not shipped; an init.openssh.rc
stub may remain (AXP Pro parity) without shipping sshd on product.
8. Kernel and memory hardening
Kernel version line: Linux 4.14 (Qualcomm msm-4.14), as shipped by Lineage for Pixel 4a — not upgraded to a GKI 6.x kernel.
7.1 Already strong on Lineage (kept)
Examples: Clang CFI, shadow call stack, stack protector, KASLR, PAN, hardened usercopy, restricted perf events, and related options in the upstream sunfish defconfig.
7.2 GrapheneOS-derived Stage 1 pack (30 patches)
Backported GrapheneOS / Android Hardening series via the AXP kernel patch collection, including:
| Series | Purpose (summary) |
|---|---|
| Deny USB | Optional hardening around USB attack surface |
| allocsize | Allocation size hardening helpers |
| bugon | ksize / BUG_ON integrity checks |
| fortify | Intra-object FORTIFY helpers in kernel |
| misc | Miscellaneous hardening commits |
| random | Brk / argument randomization |
| ro | __ro_after_init and related read-only data hardening |
| sanitize | Page / slab sanitization helpers |
| slab | SLAB hardening companions |
| unused | Removal of unused kernel API noise |
Kernel config enabled with this stack (examples):
CONFIG_FORTIFY_SOURCECONFIG_INIT_ON_ALLOC_DEFAULT_ON/CONFIG_INIT_ON_FREE_DEFAULT_ONCONFIG_SECURITY_DMESG_RESTRICTCONFIG_SLAB_HARDENEDCONFIG_SLAB_FREELIST_RANDOM(US-S5-1 class)- Yama LSM not enabled (compat with apps using self-ptrace; matches classic AXP kernel posture)
Not ported: GrapheneOS location lockdown kernel policy (this ROM keeps Lineage-style location behaviour and precision).
7.3 Userspace allocator
- hardened_malloc (64-bit) integrated into bionic for eligible processes, with exclusions for graphics / camera stacks where required for stability.
7.4 CVE backports
The ROM applies a large set of Linux kernel CVE backports on top of the 4.14 sunfish kernel, from the same curated lists used in AXP / Divest-style trees:
| Set | Count | Notes |
|---|---|---|
| Primary backport set | 429 patch entries | Stable “clean offset” apply list |
| High-offset batches 1–3 | 27 extra patch entries | Larger backports with relaxed offset matching |
| Unique CVE identifiers (combined) | 449 | Deduplicated ids in the list file below |
Full CVE identifier list: kernel-cve-backport-list.txt
(one CVE id per line, sorted).
Special cases (not in the 449 list as-is):
- CVE-2022-49980 — raw one-liner backport is denied; a lock-scope / UAF companion patch is applied instead (USB subsystem stability).
- Additional CVE paths may appear on a denylist when they conflict with sunfish drivers (Wi‑Fi, audio, etc.); those are skipped intentionally.
Platform Android security patch level follows LineageOS merges (e.g.
2026-09-01 on recent builds). Vendor (bootloader/modem) patch level
remains on the 2023-09-05 line appropriate for Pixel 4a vendor blobs.
9. Verified Boot and signing
- Builds are signed with project release keys (
release-keys). - AVB metadata uses the project key; verification flags suit an unlocked bootloader with Magisk (not a locked retail verified-boot product).
- Do not downgrade vendor security patch below the ROM’s minimum without expecting install blocks or encryption init failures.
10. Installation (summary)
- Unlock bootloader (erases data).
- Flash boot + dtbo from the same ROM package if you are not already on this ROM’s recovery (Pixel 4a uses recovery-in-boot).
- Boot recovery → Factory reset / format data.
- Apply update → ADB sideload the full
AXP-Resurrection-Pro-*.zip. - Reboot, complete setup, then Magisk first-time APK install as above.
Use the full OTA zip; flashing only boot.img does not update system,
microG, or apps.
11. What this ROM does not promise
- No official Google certification or Play Protect “device integrity” guarantee.
- No bundled Play Integrity Fix or banking modules.
- No AXP.OS online update servers or external market repositories.
- No NeoLauncher (Lineage Launcher3 remains).
- No KernelSU in the standard build.
- Banking apps may work in work profiles or Island; that is app-specific and not a ship guarantee.
12. Credits and lineage
- LineageOS — base operating system and device support.
- microG project — free Google services reimplementation.
- Magisk (topjohnwu) — root framework.
- AXP.OS / EXTENDROM — product philosophy, preroot Magisk packaging, and many userspace behaviours cloned on this port.
- GrapheneOS / Android Hardening — kernel patch series (via AXP kernel patch collection).
- Community apps: Aurora, Droidify, Fossify, OpenEUICC, Jelly, etc.
AXP Resurrection Pro is an independent community port. It is not an official LineageOS, Google, or AXP.OS GmbH product.
13. Document history
| Version | Date | Notes |
|---|---|---|
| 1.1 | 2026-10-11 | Added §2 delta vs LineageOS (features, removals, framework) |
| 1.0 | 2026-10-11 | Initial public feature list for 23.2-20261008 generation |
For maintainers: internal engineering docs remain separate under docs/ in the
source repository.