sunfish-adminandCursor
3f941e8451
Ship script gates wave 4 behind AXP_DEBLOB_WAVE4, documents secrets cert path, and adds deblob appliers plus tests; docs capture Swissquote fix and parity. Co-authored-by: Cursor <cursoragent@cursor.com>
3.5 KiB
009 — Remaining path to AXP / Graphene-class ship (post clean-429)
Stale as an execution order. Boot, vendor SPL, lock-scope, release-keys,
and hardened_malloc moved on 2026-10-08. Start from
docs/009-handoff-20261008.md.
Non-normative roadmap after LAB BOOT_OK on Stage1+combo4+FORTIFY+Magisk+
CVE clean-offset 429 (denylist CVE-2022-49980), kernel #47
(20261001T180955Z-axp-stage1-combo4-cve-clean). Authoritative requirements
remain specs/009-axp-los23-port/spec.md + constitution.
Goal (owner): almost all applicable AXP.OS / Graphene-class behaviour on LOS 23.2 sunfish Magisk track — not a blind dump, not bootloader lock.
2026-10-07 next-bacon correction: misc/0021 is already present in the
LOS kernel base. Stage1 must omit it and use patch --forward; otherwise GNU
patch auto-reverses it and shrinks KSYM_NAME_LEN 192→128 under Clang CFI.
The first corrected candidate retains 192 and applies only the
CVE-2022-49980 lock-scope companion as its new kernel delta.
Already landed (kernel / Magisk core)
| Layer | Status |
|---|---|
| Stage1 Graphene/AH | Ship |
| Combo4 + Clang FORTIFY | Ship |
| Magisk preroot EXTENDROM-class | Ship |
| CVE clean-offset 429 | Ship (LAB OK) |
CVE-2022-49980 |
Original one-liner denylisted; corrected lock-scope candidate next |
| High-offset CVE (~73) | Quarantine — triage started |
Recover/bisect baseline: 20260929T123401Z-axp-stage1-combo4 (#32).
Kernel remaining (toward “AXP CVE / Graphene depth”)
- High-offset quarantine — KEEP batches 1–3 shipped (
151944Z). nf_tables leftovers still skipped. Next kernel depth: US-S5-1 defconfig (Yama +SLAB_FREELIST_RANDOM), not more bulk CVE. CVE-2022-49980proper port — keep UAF fix without recursiveudc_lockusing the reviewed lock-scope companion. Boot and USB gadget smoke are still required; the original one-liner remains denylisted.- Failed Stage1 probes (allocsize/ro/slab) — low priority vs high-offset.
- Graphene modern techniques /
hardened_malloc— backlog (docs/hardening-backlog.md); evaluate after CVE depth is stable.
Userspace / product remaining (AXP surface)
From docs/009-capability-matrix.md / Gate G (still open or partial):
| Item | Notes |
|---|---|
| Release keys + AVB (unlocked) | US-S2/S3 — leave test-keys |
| Private DNS / connectivity check | Patches exist; keep AXP-class, no axp.os endpoints |
| Call-rec / FLAG_SECURE | 008 — selectable unlock |
| Bundled apps (Aurora, Droidify, gallery, …) | Packaging |
| Disable-app UX on A16 | Restore classic Disable |
| Hosts / DNS privacy helpers | Magisk module vs ROM-native TBD |
| WebView | LOS default (Aosmium exception) |
| Banking / Island | Deferred |
| Bootloader lock | Wont |
| KernelSU swap | Optional later; do not mix Magisk ship boots |
Suggested execution order (default if owner has no preference)
- Finish high-offset relevance filter → small apply batches (≤10) with strict applicator + LAB boot each batch.
- Wire release keys bacon of current ship pack; keep Magisk/preroot OK.
- Land remaining Settings/UX AXP clones (DNS, connectivity, disable-app) if not already on LAB zip.
- Optional: 49980 lock-scope port; Graphene userspace / hardened_malloc spikes.
Do-not
- Reflash full-503 / old kh-cve zips.
- Bulk-apply high-offset without manual review.
- Mix KernelSU into Magisk ship boots.
- Treat “almost AXP/Graphene” as requiring locked bootloader.