AXP-Resurection/docs/hardening-backlog.md

# Hardening backlog (non-normative)

Candidate hardening ideas for later evaluation. **Not requirements** until a row
is promoted into an active feature `spec.md` (`012` / `013` or related).

Authority order for an active feature:

1. Constitution
2. That feature's `spec.md`
3. This backlog / `docs/axp-pro-parity.md` (hints only)

Status: `candidate` | `investigate` | `accepted→spec` | `rejected` | `los-provides`

## Privacy / identifiers

| Idea | Notes | Status |
|------|-------|--------|
| SUPL IMSI/MSISDN exposure | Reduce carrier ID leakage via SUPL | candidate |
| Build.SERIAL restrictions | Identifier privacy | candidate |
| Analytics / statistics removal | Drop unused telemetry | candidate |
| Package query visibility | Tighten package visibility | candidate |
| MAC / address privacy | Wi-Fi/BT randomization policy | candidate |
| Private DNS defaults | Sensible defaults without breaking banks | candidate |
| CA-store review | Trust anchors audit | candidate |

## Userspace

| Idea | Notes | Status |
|------|-------|--------|
| hardened_malloc | Graphene/AXP portability on sunfish | candidate |
| Bionic hardening | Selective, attributable | candidate |
| JNI protections | Safer JNI boundaries | candidate |
| Stack canaries | Confirm / strengthen where applicable | candidate |
| ptrace / Yama | Restrict debugging attach | candidate |
| seccomp | Incremental filter improvements | candidate |
| noexec / nosuid / nodev mounts | Where applicable without breaking HW | candidate |
| Dynamic code / JIT restrictions | Evaluate app compatibility cost | candidate |
| Exec spawning / ASLR-related | Attack-surface reduction | candidate |

## Kernel

| Idea | Notes | Status |
|------|-------|--------|
| Historical GrapheneOS sunfish kernel patches/config | Device-specific commits **and** config known to have run on sunfish — not CONFIG-only review | candidate |
| Modern GrapheneOS kernel techniques | Evaluate equivalent/backport on sunfish 4.14; no blind cherry-picks | candidate |
| AXP/DivestOS sunfish kernel patch audit | Identify AXP-owned vs inherited vs upstream; de-duplicate against LOS | candidate |
| Applicable CVE backports | Document EOL firmware vs patchable kernel | candidate |
| CFI | Feasibility on 4.14 | candidate |
| ASLR config | Kernel/userspace related knobs | candidate |
| IPv6 privacy | Address generation / exposure | candidate |
| Debug / UART restrictions | Reduce attack surface | candidate |
| Attack-surface reduction | Drop unused drivers/configs carefully | candidate |

## Kernel hardening source policy

The kernel base remains the LineageOS 23.2-compatible sunfish kernel.

**Priority (009 / owner 2026-09-18):** AXP clone first → LOS inventory →
IodéOS diff → optional Graphene (modern techniques / selective A13).
**Do not** separately mine DivestOS EOL. See `docs/009-kernel-hardening-map.md`.

```text
                         ┌─ AXP sunfish (max priority clone)
                         │
LOS23/A16 sunfish 4.14 ←─┼─ LOS23 already-present
      OUR BASE           │
                         ├─ IodéOS (LOS fork, hardened/deblobbed)
                         │
                         └─ Graphene optional (modern / selective A13)
```

**Not:** GrapheneOS Android 13 (or any old GrapheneOS) kernel tree as our base.
**Not:** DivestOS as a hunt target (EOL).

Candidate hardening comes from:

1. **AXP.OS sunfish** — primary; audit actual patch stack on `rom-dev01`.
2. **LineageOS 23.2 msm-4.14** — what is already applied.
3. **IodéOS** — diff vs LOS for extra hardening/deblob worth porting.
4. **GrapheneOS** — optional: modern Pixel techniques adaptable to 4.14;
   historical sunfish A13 only if clearly still valuable.
5. **Original upstream** — when a patch derives from Linux/AOSP common,
   prefer upstream form when practical.

For each candidate record:

- security problem / property;
- original source and commit;
- source lineage / provenance;
- sunfish-specific or generic;
- already present in LOS 23.2?;
- already present through another patch?;
- kernel/hardware prerequisites;
- applicability to Linux 4.14;
- port/backport required;
- compatibility/regression risk;
- test result;
- final decision.

**Location:** do not extra-cap vs LOS (owner GPS UX); skip AXP location
lockdown in this track unless revisited later.


## Much later / evaluate

| Idea | Notes | Status |
|------|-------|--------|
| Per-app network control | High UX/complexity | candidate |
| Sensors permission model | Graphene-like | candidate |
| Storage Scopes-like behaviour | Compatibility cost | candidate |
| Contact Scopes-like behaviour | Compatibility cost | candidate |
| Duress PIN/password | Later | candidate |
| USB restrictions | Policy toggles | candidate |
| Exploit-protection toggles | User-facing switches | candidate |
| Modernize LOS API deprecations / Kotlin annotation targets | **Final-ROM hygiene (last steps)**, not a mid-feature gate. Measured on `005` bacon 2026-09-15 SUCCESS (~45k log lines): ~3k deprecated, ~4.5k KT-73255 annotation-target, ~8.7k “warning” hits total; **0** hard `error:`/`FAILED:` in successful run. Themes: Settings Slices `[removal]`; SystemUI KeyguardState/SceneContainer/CommunalScenes; DesktopMode desk APIs; `FingerprintManager`/`Executors`; SettingsLib `@StringRes` KT-73255. Fix **API-by-API** with attributable ports; never megapatch or `-Xlint:-deprecation` as “done”. Prefer waiting for LOS merges; only port what still warns at freeze. Own patches (`005` spoofing, vendor) must stay clean first. Evidence: `/srv/rom/artifacts/005-spoofing/20260915-bacon/bacon-log-triage.md`. | candidate |

## EOL firmware caveat (for `013`)

sunfish is EOL. The project can modify kernel/framework we build, but cannot
fabricate new proprietary vendor/modem firmware. Document clearly:

- security patches we can backport in-tree;
- old proprietary firmware/baseband/vendor images we **cannot** fix;
- do not claim hardware protections unsupported by Pixel 4a.