sunfish-admin
12d2179c20
Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.
69 lines
2.6 KiB
Markdown
69 lines
2.6 KiB
Markdown
# Runbook: `008` call-rec + FLAG_SECURE (LAB)
|
|
|
|
**LAB serial**: `11231JEC207477` only — never GOLDEN.
|
|
**Apply** (on `rom-dev01`):
|
|
|
|
```bash
|
|
python3 /srv/rom/src/lineage/vendor/sunfish-a16/patches/008-call-rec-flag-secure/apply_008_call_rec_flag_secure.py
|
|
```
|
|
|
|
Idempotent (second run = all “already”). Marker:
|
|
`SUNFISH_A16_008_CALL_REC_FLAG_SECURE`.
|
|
|
|
**Evidence**: `/srv/rom/artifacts/008-call-rec-flag-secure/`
|
|
**Logs**: `/srv/rom/logs/008-build/`
|
|
**Backups**: `/srv/rom/artifacts/008-call-rec-flag-secure/bak-snapshots/`
|
|
|
|
## Secure keys
|
|
|
|
| Key | Default | Source |
|
|
|-----|---------|--------|
|
|
| `extendrom_call_recording` | `0` | AXP GOLDEN / EXTENDROM (`ER_ALLOW_ANY_CALL_REC`) |
|
|
| `disable_secure_windows` | `0` | AOSP A16 `Settings.Secure.DISABLE_SECURE_WINDOWS` (DO UI key `allow_flag_secure_override`) |
|
|
|
|
GOLDEN dump: `extendrom_call_recording=1` in
|
|
`.local-artifacts/002-golden/…/settings/secure-*.txt`.
|
|
|
|
## Call-rec — EXTENDROM `F_CALLREC` (applied)
|
|
|
|
| Step | LOS 23.2 path | Status |
|
|
|------|---------------|--------|
|
|
| Dialer config | `packages/apps/Dialer/.../callrecord/res/values/config.xml` | already `enabled=true`, audio `4` |
|
|
| Controllers | `Settings/.../ER_CallRecPreferenceController.java` + `ER_CallRecInfo.java` | applied |
|
|
| Dashboard | `DevelopmentSettingsDashboardFragment.java` | applied |
|
|
| DO XML | `Settings/res/xml/development_settings.xml` | applied |
|
|
| Strings | `Settings/res/values/strings.xml` | applied |
|
|
| Secure const | `frameworks/base/.../Settings.java` `ER_ALLOW_ANY_CALL_REC` | applied |
|
|
| Dialer gate | `Dialer/.../CallRecorder.java` `canRecordInCurrentCountry` | applied |
|
|
|
|
## FLAG_SECURE — A16 inventory (applied via DO only)
|
|
|
|
AOSP already implements the capture path:
|
|
|
|
- `WindowState.isSecureLocked()` → early false if
|
|
`mWmService.getDisableSecureWindows()`
|
|
- `WindowManagerService.updateDisableSecureWindows()` reads
|
|
`Settings.Secure.DISABLE_SECURE_WINDOWS`
|
|
- **Only when** `ro.debuggable` / `SYSTEM_DEBUGGABLE` is true (LAB
|
|
`userdebug` OK; `user` needs retest / possible gate lift later)
|
|
|
|
Project work: Settings DO writes that Secure key (no Magisk / no jar patcher).
|
|
|
|
## Validation
|
|
|
|
See `specs/008-call-rec-flag-secure/quickstart.md`.
|
|
|
|
After bacon + flash Magisk-free:
|
|
|
|
```bash
|
|
adb -s 11231JEC207477 shell settings get secure extendrom_call_recording
|
|
adb -s 11231JEC207477 shell settings get secure disable_secure_windows
|
|
```
|
|
|
|
## `user` vs `userdebug`
|
|
|
|
LAB = `userdebug` (DO + WMS secure-windows disable active). Before release
|
|
(`011`), re-check on `user`: DO visibility (like `005`) and whether
|
|
`updateDisableSecureWindows` still no-ops when not debuggable — document
|
|
outcome; do not silently claim `user` PASS.
|