sunfish-adminandCursor
3f941e8451
Ship script gates wave 4 behind AXP_DEBLOB_WAVE4, documents secrets cert path, and adds deblob appliers plus tests; docs capture Swissquote fix and parity. Co-authored-by: Cursor <cursoragent@cursor.com>
1.8 KiB
1.8 KiB
US-S5-1 — Yama + SLAB freelist random (defconfig)
Track: AXP Resurection Pro Magisk, unlocked sunfish.
On top of: Stage1 + combo4 + FORTIFY + CVE clean-429 + hi-batch1–3.
Why
High-offset KEEP CVEs are already on the ship pack. Remaining ge200 KEPT
items were nf_tables (CVE-2023-3777, CVE-2024-26643) — skipped on
purpose in batch3. Next attributable kernel depth without reopening CVE
quarantine:
| Knob | Before | After | Attribution |
|---|---|---|---|
CONFIG_SECURITY_YAMA |
unset (but CONFIG_LSM listed yama) |
=y |
Graphene/AXP LSM stack; ptrace scope |
CONFIG_SLAB_FREELIST_RANDOM |
unset | =y |
Graphene/AH slab hardening companion to existing SLAB_FREELIST_HARDENED |
Apply
bash vendor/sunfish-a16/patches/009-kernel-hardening/apply_uss5_1_defconfig.sh \
kernel/google/msm-4.14
Wired into scripts/009-bacon-axp-stage1-combo4-cve-hi-releasekeys.sh after
Stage1+combo4+CVE apply.
LAB verify
zcat /proc/config.gz | grep CONFIG_SECURITY_YAMA=y
zcat /proc/config.gz | grep CONFIG_SLAB_FREELIST_RANDOM=y
cat /proc/sys/kernel/yama/ptrace_scope # expect 2 (ship policy)
pidof magiskd # still up
The ship script now applies apply_009_yama_ptrace.py, so the current LAB
policy is ptrace_scope=2, not the kernel default 1. Matching AXP's
persist.native_debug 0/2 toggle is a separate userspace change and must not
be mixed into the CVE-2022-49980 boot test.
Out of scope here
- The original
CVE-2022-49980/ANY/0001.patchremains denylisted. The next isolated bacon appliesports/cve-2022-49980-lock-scope.patchinstead. - nf_tables high-offset CVEs
- Stage1 slab FAIL patches (
0010/0018still reject on this tree) hardened_malloc/ bootloader lock