sunfish-adminandCursor
3f941e8451
Ship script gates wave 4 behind AXP_DEBLOB_WAVE4, documents secrets cert path, and adds deblob appliers plus tests; docs capture Swissquote fix and parity. Co-authored-by: Cursor <cursoragent@cursor.com>
80 lines
3.5 KiB
Markdown
80 lines
3.5 KiB
Markdown
# 009 — Remaining path to AXP / Graphene-class ship (post clean-429)
|
||
|
||
**Stale as an execution order.** Boot, vendor SPL, lock-scope, release-keys,
|
||
and `hardened_malloc` moved on 2026-10-08. Start from
|
||
`docs/009-handoff-20261008.md`.
|
||
|
||
|
||
|
||
Non-normative roadmap after LAB **BOOT_OK** on Stage1+combo4+FORTIFY+Magisk+
|
||
**CVE clean-offset 429** (denylist `CVE-2022-49980`), kernel `#47`
|
||
(`20261001T180955Z-axp-stage1-combo4-cve-clean`). Authoritative requirements
|
||
remain `specs/009-axp-los23-port/spec.md` + constitution.
|
||
|
||
Goal (owner): **almost all** applicable AXP.OS / Graphene-class behaviour on
|
||
LOS 23.2 sunfish Magisk track — not a blind dump, not bootloader lock.
|
||
|
||
**2026-10-07 next-bacon correction:** `misc/0021` is already present in the
|
||
LOS kernel base. Stage1 must omit it and use `patch --forward`; otherwise GNU
|
||
patch auto-reverses it and shrinks `KSYM_NAME_LEN` 192→128 under Clang CFI.
|
||
The first corrected candidate retains 192 and applies only the
|
||
`CVE-2022-49980` lock-scope companion as its new kernel delta.
|
||
|
||
## Already landed (kernel / Magisk core)
|
||
|
||
| Layer | Status |
|
||
|-------|--------|
|
||
| Stage1 Graphene/AH | Ship |
|
||
| Combo4 + Clang FORTIFY | Ship |
|
||
| Magisk preroot EXTENDROM-class | Ship |
|
||
| CVE clean-offset 429 | Ship (LAB OK) |
|
||
| `CVE-2022-49980` | Original one-liner denylisted; corrected lock-scope candidate next |
|
||
| High-offset CVE (~73) | Quarantine — triage started |
|
||
|
||
Recover/bisect baseline: `20260929T123401Z-axp-stage1-combo4` (`#32`).
|
||
|
||
## Kernel remaining (toward “AXP CVE / Graphene depth”)
|
||
|
||
1. **High-offset quarantine** — KEEP batches 1–3 **shipped** (`151944Z`).
|
||
nf_tables leftovers still skipped. Next kernel depth: **US-S5-1** defconfig
|
||
(Yama + `SLAB_FREELIST_RANDOM`), not more bulk CVE.
|
||
2. **`CVE-2022-49980` proper port** — keep UAF fix without recursive
|
||
`udc_lock` using the reviewed lock-scope companion. Boot and USB gadget
|
||
smoke are still required; the original one-liner remains denylisted.
|
||
3. Failed Stage1 probes (allocsize/ro/slab) — low priority vs high-offset.
|
||
4. Graphene modern techniques / `hardened_malloc` — backlog (`docs/hardening-backlog.md`);
|
||
evaluate after CVE depth is stable.
|
||
|
||
## Userspace / product remaining (AXP surface)
|
||
|
||
From `docs/009-capability-matrix.md` / Gate G (still open or partial):
|
||
|
||
| Item | Notes |
|
||
|------|--------|
|
||
| Release keys + AVB (unlocked) | US-S2/S3 — leave test-keys |
|
||
| Private DNS / connectivity check | Patches exist; keep AXP-class, no axp.os endpoints |
|
||
| Call-rec / FLAG_SECURE | `008` — selectable unlock |
|
||
| Bundled apps (Aurora, Droidify, gallery, …) | Packaging |
|
||
| Disable-app UX on A16 | Restore classic Disable |
|
||
| Hosts / DNS privacy helpers | Magisk module vs ROM-native TBD |
|
||
| WebView | LOS default (Aosmium exception) |
|
||
| Banking / Island | Deferred |
|
||
| Bootloader lock | Wont |
|
||
| KernelSU swap | Optional later; do not mix Magisk ship boots |
|
||
|
||
## Suggested execution order (default if owner has no preference)
|
||
|
||
1. Finish high-offset **relevance filter** → small apply batches (≤10) with
|
||
strict applicator + LAB boot each batch.
|
||
2. Wire **release keys** bacon of current ship pack; keep Magisk/preroot OK.
|
||
3. Land remaining **Settings/UX** AXP clones (DNS, connectivity, disable-app)
|
||
if not already on LAB zip.
|
||
4. Optional: 49980 lock-scope port; Graphene userspace / hardened_malloc spikes.
|
||
|
||
## Do-not
|
||
|
||
- Reflash full-503 / old kh-cve zips.
|
||
- Bulk-apply high-offset without manual review.
|
||
- Mix KernelSU into Magisk ship boots.
|
||
- Treat “almost AXP/Graphene” as requiring locked bootloader.
|