sunfish-admin
deaaf42caa
Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding, bundled apps, and AXP-class product surface docs/scripts.
32 lines
1.0 KiB
Bash
Executable File
32 lines
1.0 KiB
Bash
Executable File
#!/bin/bash
|
|
# US-S5-1 — enable remaining Graphene/AXP-class defconfig knobs on msm-4.14.
|
|
#
|
|
# Oracle: AXP/Graphene kernel hardening expects Yama + slab freelist random
|
|
# (combo4 already ships SLAB_FREELIST_HARDENED). LOS sunfish_defconfig left both
|
|
# off; CONFIG_LSM already lists yama but SECURITY_YAMA was unset so the LSM
|
|
# never built.
|
|
#
|
|
# Does NOT apply high-offset CVE leftovers (nf_tables deliberately skipped) or
|
|
# CVE-2022-49980 (denylist until lock-scope port).
|
|
#
|
|
# Usage: apply_uss5_1_defconfig.sh <kernel-tree>
|
|
set -euo pipefail
|
|
|
|
K=${1:?kernel tree}
|
|
DEF="$K/arch/arm64/configs/sunfish_defconfig"
|
|
test -f "$DEF"
|
|
test -f "$K/security/yama/Kconfig"
|
|
|
|
for k in SECURITY_YAMA SLAB_FREELIST_RANDOM; do
|
|
sed -i "/CONFIG_${k}/d" "$DEF"
|
|
# drop "# CONFIG_FOO is not set" lines too (sed above only matches CONFIG_FOO=)
|
|
sed -i "/# CONFIG_${k} is not set/d" "$DEF"
|
|
done
|
|
|
|
{
|
|
echo "CONFIG_SECURITY_YAMA=y"
|
|
echo "CONFIG_SLAB_FREELIST_RANDOM=y"
|
|
} >> "$DEF"
|
|
|
|
echo "OK: US-S5-1 defconfig (YAMA + SLAB_FREELIST_RANDOM) on $K"
|