sunfish-adminandCursor
2d145c2878
Restore disable_configstore, EuiccDisabler and thermal CDEV guards, branding and rebuild/sync helpers; document device roles, laptop migration, and Gitea. Co-authored-by: Cursor <cursoragent@cursor.com>
37 lines
1.3 KiB
Bash
Executable File
37 lines
1.3 KiB
Bash
Executable File
#!/bin/bash
|
|
# US-S5-1 — remaining Graphene/AXP-class defconfig knobs on msm-4.14.
|
|
#
|
|
# SLAB_FREELIST_RANDOM: LOS sunfish_defconfig leaves it off (combo4 already
|
|
# ships SLAB_FREELIST_HARDENED).
|
|
#
|
|
# SECURITY_YAMA: GOLDEN's running 4.14.355 config leaves it unset, so AXP's
|
|
# init ptrace_scope writes are inert there. With Yama built, scope 2 denies
|
|
# PairIP's self-ptrace (Wallapop SIGSEGV, LAB 2026-10-10). Match GOLDEN.
|
|
#
|
|
# Does NOT apply high-offset CVE leftovers (nf_tables deliberately skipped).
|
|
# CVE-2022-49980's one-liner stays on the denylist. The bacon applies
|
|
# ports/cve-2022-49980-lock-scope.patch after the CVE lists.
|
|
#
|
|
# USERFAULTFD: GOLDEN's running 4.14.355 config leaves it unset. LOS 23
|
|
# sunfish_defconfig turns it on. This kernel has no UFFDIO_MOVE (that ioctl
|
|
# is 6.1+), so ART only opens a fd and times out. Match GOLDEN.
|
|
#
|
|
# Usage: apply_uss5_1_defconfig.sh <kernel-tree>
|
|
set -euo pipefail
|
|
|
|
K=${1:?kernel tree}
|
|
DEF="$K/arch/arm64/configs/sunfish_defconfig"
|
|
test -f "$DEF"
|
|
|
|
for k in SECURITY_YAMA SLAB_FREELIST_RANDOM USERFAULTFD HAVE_ARCH_USERFAULTFD_MINOR; do
|
|
sed -i "/CONFIG_${k}/d" "$DEF"
|
|
done
|
|
|
|
{
|
|
echo "# CONFIG_SECURITY_YAMA is not set"
|
|
echo "CONFIG_SLAB_FREELIST_RANDOM=y"
|
|
echo "# CONFIG_USERFAULTFD is not set"
|
|
} >> "$DEF"
|
|
|
|
echo "OK: US-S5-1 defconfig (SLAB_FREELIST_RANDOM; YAMA, USERFAULTFD off) on $K"
|