sunfish-admin
deaaf42caa
Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding, bundled apps, and AXP-class product surface docs/scripts.
84 lines
3.0 KiB
Markdown
84 lines
3.0 KiB
Markdown
# 009 kernel hardening Stage 1 (FR-017)
|
||
|
||
**Source**: AXP `kernel_patches` @ `df3cab2155b3` (GrapheneOS / AndroidHardening
|
||
series in Divest-era layout).
|
||
**Base**: LOS `kernel/google/msm-4.14` @ `28f9290ae067` (`4.14.357-openela`).
|
||
**Map**: `docs/009-kernel-hardening-map.md`.
|
||
|
||
## Files
|
||
|
||
| File | Role |
|
||
|------|------|
|
||
| `stage1.list` | Ordered allowlist (30 patches) |
|
||
| `apply_stage1.sh` | Applies list onto a kernel tree |
|
||
|
||
## Host usage (`rom-dev01`)
|
||
|
||
```bash
|
||
# dry-run
|
||
bash vendor/sunfish-a16/patches/009-kernel-hardening/apply_stage1.sh \
|
||
/srv/rom/src/lineage/kernel/google/msm-4.14 --dry-run
|
||
|
||
# apply (dirties the lineage kernel checkout)
|
||
bash vendor/sunfish-a16/patches/009-kernel-hardening/apply_stage1.sh \
|
||
/srv/rom/src/lineage/kernel/google/msm-4.14
|
||
```
|
||
|
||
Optional: `AXP_KERNEL_PATCHES=/path/to/kernel_patches`.
|
||
|
||
After apply, flip `sunfish_defconfig` options that the new Kconfig allows
|
||
(at least `CONFIG_FORTIFY_SOURCE=y`); see map `KH-CFG`.
|
||
|
||
## Boot-OK pack (2026-09-28 LAB) — prefer for Magisk bacon
|
||
|
||
Stage1 Graphene alone historically hung at the Google logo on LOS23/Clang.
|
||
The pack that boots with Magisk-track `boot-make` is **combo4 + Clang FORTIFY**
|
||
(no Stage1 mega-pack):
|
||
|
||
```bash
|
||
# on a reset msm-4.14 @ 28f9290ae067:
|
||
bash vendor/sunfish-a16/patches/009-kernel-hardening/apply_combo4_fortify.sh \
|
||
/path/to/msm-4.14
|
||
```
|
||
|
||
That applies `fortify-clang/` (incl. nested `__underlying_strlen` fix) +
|
||
driver bounds + defconfig:
|
||
`FORTIFY_SOURCE`, `INIT_ON_*`, `SECURITY_DMESG_RESTRICT`,
|
||
`SLAB_FREELIST_HARDENED`. Bacon entrypoint:
|
||
`scripts/009-bacon-axp-combo4-fortify.sh`.
|
||
|
||
## Stage1 + combo4 (full bacon, Wi‑Fi coherent)
|
||
|
||
```bash
|
||
# reset msm-4.14 @ 28f9290ae067, then:
|
||
bash vendor/sunfish-a16/patches/009-kernel-hardening/apply_stage1_combo4.sh \
|
||
/path/to/msm-4.14
|
||
# bacon: scripts/009-bacon-axp-stage1-combo4.sh
|
||
```
|
||
|
||
Order: Stage1 (30) → slab BUILD-FIXES if needed → combo4+FORTIFY.
|
||
Ship via **sideload of the zip** (matching vendor/`wlan.ko`). Do not flash
|
||
only the new boot onto an old slot.
|
||
|
||
**LAB accepted 2026-09-29:** see `docs/009-gate-g-kernel-attribution.md`.
|
||
|
||
## GPS / location (FR-018 — do not regress)
|
||
|
||
Owner wants **precise, fast GPS** (stock LOS behaviour). **Never** apply AXP
|
||
location lockdown, SUPL/IMSI stripping that hurts TTFF, or extra location
|
||
caps vs LOS 23.2. Stage1 list, `cve-strict.list`, and denylist must stay
|
||
free of location-lockdown series (`KH-LOC` = skip). If a future CVE hunk
|
||
touches GNSS/GPS paths only for a real security fix, keep LOS-equivalent
|
||
behaviour and document; do not “harden location” as a side goal.
|
||
|
||
## Not in Stage 1 alone
|
||
|
||
- CVE mega — now staged via `apply_stage1_combo4_cve.sh` + `cve-strict.list`
|
||
(~503 AXP allowlist from 2026-09-18 strict pass; `cve-denylist.txt` skipped).
|
||
Bacon: `scripts/009-bacon-axp-stage1-combo4-cve.sh` (test-keys; after
|
||
boot-OK Stage1 pack). **Do not** flash `20260918*-axp-kh-cve/full`.
|
||
- LinuxIncrementals
|
||
- Failed probe patches (port later)
|
||
- Location lockdown (FR-018)
|
||
- Iodé kernel (no sunfish 4.14 fork found)
|