AXP-Resurection/docs/009-gate-g-kernel-attribution.md

Gate G / FR-017 — kernel hardening attribution (ship candidate)

What “Gate G doc” means: the acceptance contract asks for a written list of what kernel hardening we applied, what we skipped and why, plus userspace AVB/signing gaps (or “impossible on this stack”). This file is that list for the kernel half. Userspace AVB is tracked separately below as still open.

LAB device: 11231JEC207477 only.

2026-10-07 correction / next bacon: LAB currently runs the 20261007T133154Z PRO/user/release-keys artifact. Audit found that Stage1 treated misc/0021 as reversed and silently changed the LOS base's KSYM_NAME_LEN from 192 to 128 while CONFIG_CFI_CLANG=y. The next recipe removes that already-present patch, invokes Stage1 with patch --forward, and gates KSYM_NAME_LEN=192. Artifact 20261007T161115Z is quarantined and must not be flashed. Its corrected replacement, 20261007T171530Z, completed all artifact gates and keeps the original CVE one-liner denylisted while testing only the lock-scope companion as the new kernel delta. It remains unflashed pending LAB USB-gadget acceptance. The historical acceptance record below remains unchanged.

Accepted kernel ship pack (LAB 2026-10-01): Stage1 Graphene/AH + combo4 + Clang FORTIFY + Magisk preroot + CVE clean-offset 429 + hi-batch1+2 (15) with CVE-2022-49980 denylisted. Clean-only #47 / hi-batch1 #48 remain bisect GOODs.

Prior Stage1-only pack 20260929T123401Z-axp-stage1-combo4 remains the recover / bisect GOOD baseline (kernel #32).

Current accepted artifact

Field	Value
Artifact	/srv/rom/artifacts/009-axp-los23-port/20261001T201836Z-axp-stage1-combo4-cve-hi-batch2/
Local flash copy	.local-artifacts/009-flash-cve-hi-batch2/
Prior hi-batch1 GOOD	20261001T192418Z-…-cve-hi-batch1/ (#48)
Prior clean GOOD	20261001T180955Z-…-cve-clean/ (#47)
Kernel base	LOS msm-4.14 @ 28f9290ae067 (4.14.357-openela)
Running LAB (boot flash)	slot _a, kernel #49 Thu Oct 1 19:49:54 UTC 2026
CVE list	clean 429 + hi-batch1 (7) + hi-batch2 (8)
Apply quality	clean OK=429; hi OK=15 fuzz≤1 (elevated abs-offset)
Note	host detach exit=141 after bacon_exit=0 = tee SIGPIPE, not a real fail
Magisk	EXTENDROM-class preroot v30.7 (virgin until Additional Setup; magiskd OK)
KernelSU	absent (Magisk track)

Flash procedure that works: recovery → (optional wipe) → sideload zip → Reboot system. Bisect/CVE boots may use fastboot -s 11231JEC207477 flash boot only when CRC/modules match the installed vendor. Do not flash Magisk boot.img onto the other slot alone (new kernel + old vendor ⇒ wlan CRC mismatch).

Build entrypoints:

• Apply: apply_stage1_combo4.sh then apply_cve_strict.sh with CVE_STRICT_LIST=…/cve-clean-offset.list (denylist includes 49980)
• Bacon: scripts/009-bacon-axp-stage1-combo4-cve-clean.sh (or 009-bacon-cve-clean-post49980 host wrapper)
• Baseline-only: scripts/009-bacon-axp-stage1-combo4.sh

Applied (attributable)

A. Combo4 defconfig + Clang FORTIFY port

Item	Source / notes
CONFIG_FORTIFY_SOURCE=y	Ship; Clang port required on this toolchain
CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y	Combo4
CONFIG_INIT_ON_FREE_DEFAULT_ON=y	Combo4
CONFIG_SECURITY_DMESG_RESTRICT=y	Combo4
CONFIG_SLAB_FREELIST_HARDENED=y	Combo4 (not SLAB_HARDENED alone)
Clang FORTIFY / __pass_object_size	fortify-clang/apply_fortify_clang.py (Kees-class port adapted to 4.14 string.h)
Nested strlen fix	strlcpy/strcpy use __underlying_strlen(q) — LAB smoking gun 2026-09-28
Driver bounds	fortify-clang/0001-driver-bounds-rtac-fils.patch (link/false-path)
# CONFIG_KSU is not set	Magisk track

B. Stage1 Graphene / AndroidHardening (30 patches)

Source tree: AXP kernel_patches (host /srv/rom/references/axp/kernel_patches).
List: vendor/sunfish-a16/patches/009-kernel-hardening/stage1.list via apply_stage1.sh.

Includes (series names): Deny_USB, allocsize (partial), bugon, fortify strict-string patch (AXP 0004 — not a substitute for the Clang port), misc, random, ro, sanitize, slab, unused, etc. Full paths in stage1.list.

LAB marker: /proc/sys/kernel/deny_new_usb present (Graphene Deny USB).

Build fix retained: Stage1 slab/0014 misfuzz into is_root_cache → reverted in apply_stage1_combo4.sh when detected (BUILD-FIXES.md).

Explicitly NOT in this ship pack

Item	Why
Full cve-strict.list (~503)	Logo hang; includes high-offset (≥200) and CVE-2022-49980. Do not reflash 20260929T181525Z-…-cve / old *-kh-cve.
CVE-2022-49980 (USB gadget UAF)	Denylist. Alone reproduces Google-logo hang on LAB (2026-10-01). One-liner takes udc_lock in usb_udc_uevent while this 4.14 tree still fires uevents under the same lock (device_add / bind / unbind). Needs lock-scope companion port, not bulk apply. See docs/009-cve-bisect-plan.md.
High-offset CVE set (cve-high-offset-ge200.txt, ~73)	Quarantine + sunfish filter (26 KEEP). hi-batch1+2 (15) LAB BOOT_OK #49. Remaining KEEP ~10 (skip 3777/26643 nf_tables-class).
LinuxIncrementals	Skipped (policy / scope)
Failed Stage1 probes	allocsize/0007, ro/0007+0034, slab/0010+0018 — port later
Location lockdown	FR-018 — skip forever on this track; keep GPS precise/fast (LOS defaults)
FORTIFY BUG() overflow stubs	Invalid ship fix; never reuse
KernelSU / SusFS	Out of Magisk ship track (optional later recycle)
Userspace Deblob (Widevine/IMS/CNE)	Deferred (mobile data / Widevine)
Bootloader lock	Wont (AXP/LOS unlocked norm)

Historical note (why this pack exists)

1. Stage1 / CVE / kh-full bacons of 2026-09-18 compiled but did not boot on LAB (logo hang).
2. Bisect found Clang FORTIFY + nested strlen inside strlcpy as a hard brick; combo4 without broken FORTIFY booted.
3. Fixed FORTIFY → combo4+FORTIFY Magisk bacon OK → Stage1 re-tried on that baseline → LAB OK 2026-09-29.

Userspace Gate G (still open)

Kernel attribution above satisfies the FR-017 / SC-010 kernel bullet. Userspace / signing work is not done by this kernel bacon.

In scope (do)

Item	Intent
Release / definitive signing keys	Ship OTAs and images signed with project release keys (not AOSP test-keys). Phonesky and update identity stay on that key across releases. Secrets stay on rom-dev01 under /srv/rom/secrets/ — never in Git.
AVB as applicable on unlocked sunfish	Match GOLDEN/AXP-class AVB build posture where LOS 23.2 allows; document any gap that is impossible without locked bootloader or vendor glue we do not have.
Userspace hardening	Staged Graphene/AXP-class patches (and CVE mega on the boot-OK kernel pack) — attributable, bisectable.
CVE mega (kernel)	Partial ship: clean-offset 429 on Stage1+combo4+FORTIFY (LAB OK). Remaining: high-offset quarantine + proper 49980 port. Never flash 20260918*-kh-cve/full or full-503 BAD packs.

Out of scope (explicit skip)

Item	Why
Bootloader relock / locked-device ship	Neither AXP.OS nor LineageOS ship a locked-bootloader product as the normal path. IOdes does; we are not cloning that model. LAB and end-user sunfish remain unlocked for Magisk preroot / sideload workflow. Do not treat “cannot lock bootloader” as a Gate G failure.

Gap rule unchanged: anything still missing from the in-scope rows must be present or written down as impossible on this stack — no silent omit.

Checklist + measured GOLDEN vs LAB: docs/009-hardening-signing-checklist.md (T040). LAB 2026-09-29 is still userdebug/test-keys/orange; GOLDEN is user/release-keys/orange unlocked — same unlock class, missing project keys.

Prior known-good (fallback)

Artifact	Role
20260929T033128Z-axp-combo4-fortify	Magisk + combo4+FORTIFY without Stage1
20260918T143547Z-axp-full	Pre-KH Magisk baseline (bisect GOODMAKE source)

Owner LAB smoke (2026-09-29)

Owner reported Magisk, microG, and related checks OK on Stage1 pack after sideload to slot _b. Optional: second sideload to refresh leftover slot _a (not required for daily use).