sunfish-adminandCursor
3f941e8451
Ship script gates wave 4 behind AXP_DEBLOB_WAVE4, documents secrets cert path, and adds deblob appliers plus tests; docs capture Swissquote fix and parity. Co-authored-by: Cursor <cursoragent@cursor.com>
49 lines
1.8 KiB
Markdown
49 lines
1.8 KiB
Markdown
# US-S5-1 — Yama + SLAB freelist random (defconfig)
|
||
|
||
**Track**: AXP Resurection Pro Magisk, unlocked sunfish.
|
||
**On top of**: Stage1 + combo4 + FORTIFY + CVE clean-429 + hi-batch1–3.
|
||
|
||
## Why
|
||
|
||
High-offset KEEP CVEs are already on the ship pack. Remaining ge200 KEPT
|
||
items were **nf_tables** (`CVE-2023-3777`, `CVE-2024-26643`) — skipped on
|
||
purpose in batch3. Next attributable kernel depth without reopening CVE
|
||
quarantine:
|
||
|
||
| Knob | Before | After | Attribution |
|
||
|------|--------|-------|-------------|
|
||
| `CONFIG_SECURITY_YAMA` | unset (but `CONFIG_LSM` listed yama) | `=y` | Graphene/AXP LSM stack; ptrace scope |
|
||
| `CONFIG_SLAB_FREELIST_RANDOM` | unset | `=y` | Graphene/AH slab hardening companion to existing `SLAB_FREELIST_HARDENED` |
|
||
|
||
## Apply
|
||
|
||
```bash
|
||
bash vendor/sunfish-a16/patches/009-kernel-hardening/apply_uss5_1_defconfig.sh \
|
||
kernel/google/msm-4.14
|
||
```
|
||
|
||
Wired into `scripts/009-bacon-axp-stage1-combo4-cve-hi-releasekeys.sh` after
|
||
Stage1+combo4+CVE apply.
|
||
|
||
## LAB verify
|
||
|
||
```text
|
||
zcat /proc/config.gz | grep CONFIG_SECURITY_YAMA=y
|
||
zcat /proc/config.gz | grep CONFIG_SLAB_FREELIST_RANDOM=y
|
||
cat /proc/sys/kernel/yama/ptrace_scope # expect 2 (ship policy)
|
||
pidof magiskd # still up
|
||
```
|
||
|
||
The ship script now applies `apply_009_yama_ptrace.py`, so the current LAB
|
||
policy is `ptrace_scope=2`, not the kernel default `1`. Matching AXP's
|
||
`persist.native_debug` 0/2 toggle is a separate userspace change and must not
|
||
be mixed into the CVE-2022-49980 boot test.
|
||
|
||
## Out of scope here
|
||
|
||
- The original `CVE-2022-49980/ANY/0001.patch` remains denylisted. The next
|
||
isolated bacon applies `ports/cve-2022-49980-lock-scope.patch` instead.
|
||
- nf_tables high-offset CVEs
|
||
- Stage1 slab FAIL patches (`0010`/`0018` still reject on this tree)
|
||
- `hardened_malloc` / bootloader lock
|