AXP-Resurection/docs/009-us-s4-userspace-hardening.md

US-S4 — Userspace hardening (first stage)

Status 2026-10-02. No bacon solely for this doc.

Stage 0 — LAB baseline (measure, closed)

On LAB 11231JEC207477 after AVB ship 20261002T103558Z (+ boot/vbmeta reinforce):

Check	Result
SELinux	Enforcing
Encryption	ro.crypto.state=encrypted, ro.crypto.type=file
Verified boot	orange / flash.locked=0 (unlocked Magisk track)
security.perf_harden	1 (already)
Yama / ptrace_scope	done (US-S5-1 162840Z) — CONFIG_SECURITY_YAMA=y

Stage 1 — US-S4-1 drop product OpenSSH / rsync / procmem

Oracle: AXP.OS-22.2-20260324-PRO-sunfish.zip product (+ system) images — no sshd/ssh/rsync/procmem binaries; orphan init.openssh.rc only.

Shipped in tree: vendor/sunfish-a16/hardening.mk + patches/009-axp-los23-port/hardening/README.md.

Removes Lineage product OpenSSH binaries + rsync, procmem (DEBUG). Keeps init.openssh.rc (AXP PRO still has it). Admin path: adb + Magisk.

LAB verify after flash: no /product/bin/sshd, no /product/bin/rsync, /product/etc/init/init.openssh.rc present, Magisk still up.

Stage 2 — US-S4-2 drop Jelly + Gallery2

Oracle: AXP PRO product has neither; Fossify on system_ext. See docs/009-axp-pro-product-apps-20260324.md.

Wired: apply_009_drop_jelly_gallery2.py, NoLineageJelly phony override, hardening.mk filter, bacon gate. Pending next bacon + LAB.

Later candidates (one per bacon when risk unclear)

1. Mount / noexec where stock sunfish already allows (verify HW first)
2. Package-visibility / query hardening (high app-compat risk → later)
3. Further debug-tool trim (adb_root only if LAB proves unused)

Promote from docs/hardening-backlog.md only with upstream attribution.

Out of scope here

• WITH_AVB=true / flags 0
• Bootloader relock
• lineage_sunfish-user default lunch (US-S6)
• Kernel Yama / more CVE (US-S5)