sunfish-admin
12d2179c20
Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.
1.5 KiB
1.5 KiB
Contract: KernelSU hide / umount surface
Feature: 007-kernelsu-sunfish
Consumers: LAB validation (quickstart.md), future 011 signed builds
Root grant
| Rule | Requirement |
|---|---|
| Default | No app has root until explicitly allowed |
| Banking | com.yuh, com.swissquote.android → deny on all tested userIds |
| Proof | Manager UI alone insufficient; show failed su/root API from those UIDs |
Mount hide
| Rule | Requirement |
|---|---|
| Mechanism | KernelSU umount / profile hide (and SusFS when enabled) |
| Proof | From banking (or probe) UID, sensitive module/overlay paths that appear |
| to a normal rooted UID are absent or inaccessible | |
path_umount |
Must work on this 4.14 integration or be explicitly filed as blocker |
Non-goals
- Magisk DenyList semantics as the production contract
- LSPosed/Zygisk hide
- Claiming “legitimate system” without Yuh PASS (see
banking-yuh-gate.md)
Mandatory evidence checklist
For each banking package × tested user ID, record PASS/FAIL, method and artifact:
- root grant denied;
- denied root access demonstrated;
- module mount visibility before/after recorded;
- configured unmount mechanism actually removes the test mount.
All rows must PASS. A probe must reproduce the target policy and namespace; a different UID with unrelated settings is not evidence for the banking UID. Unavailable evidence is unverified, not PASS. Optional SUSFS checks apply only when enabled and must identify their tested paths.