AXP-Resurection/vendor/sunfish-a16/patches/009-kernel-hardening/uss5-1-README.md

US-S5-1 — Yama + SLAB freelist random (defconfig)

Track: AXP Resurection Pro Magisk, unlocked sunfish.
On top of: Stage1 + combo4 + FORTIFY + CVE clean-429 + hi-batch1–3.

Why

High-offset KEEP CVEs are already on the ship pack. Remaining ge200 KEPT items were nf_tables (CVE-2023-3777, CVE-2024-26643) — skipped on purpose in batch3. Next attributable kernel depth without reopening CVE quarantine:

Knob	Before	After	Attribution
CONFIG_SECURITY_YAMA	unset (but CONFIG_LSM listed yama)	=y	Graphene/AXP LSM stack; ptrace scope
CONFIG_SLAB_FREELIST_RANDOM	unset	=y	Graphene/AH slab hardening companion to existing SLAB_FREELIST_HARDENED

Apply

bash vendor/sunfish-a16/patches/009-kernel-hardening/apply_uss5_1_defconfig.sh \
  kernel/google/msm-4.14

Wired into scripts/009-bacon-axp-stage1-combo4-cve-hi-releasekeys.sh after Stage1+combo4+CVE apply.

LAB verify

zcat /proc/config.gz | grep CONFIG_SECURITY_YAMA=y
zcat /proc/config.gz | grep CONFIG_SLAB_FREELIST_RANDOM=y
cat /proc/sys/kernel/yama/ptrace_scope   # expect 1 (default)
pidof magiskd                            # still up

Out of scope here

• CVE-2022-49980 lock-scope port (still denylist)
• nf_tables high-offset CVEs
• Stage1 slab FAIL patches (0010/0018 still reject on this tree)
• hardened_malloc / bootloader lock