Minor tweaks

- 14.1+15.1+16.0: enable kernel protections for files
 - protected_*: hardlinks, symlinks, fifos, regular
 - from GrapheneOS
- defconfig: enable more verity options
- cleanup

Misc/16.0-recovery_audit2allow.txt

@@ -0,0 +1,27 @@
+#============= init ==============
+allow init rootfs:file create;
+allow init rootfs:lnk_file setattr;
+
+#============= recovery ==============
+allow recovery pstorefs:dir search;
+allow recovery pstorefs:file { open read };
+allow recovery selinuxfs:file write;
+allow recovery sysfs_devices_block:file { open write };
+allow recovery sysfs_scsi_devices_0000:file { open write };
+allow recovery sysfs_scsi_devices_other:file { open write };
+
+
+
+
+#============= init ==============
+allow init rootfs:file create;
+
+#============= recovery ==============
+allow recovery alarm_boot_prop:file { getattr open };
+allow recovery alarm_handled_prop:file { getattr open };
+allow recovery alarm_instance_prop:file { getattr open };
+allow recovery bg_boot_complete_prop:file open;
+allow recovery self:capability fsetid;
+allow recovery self:capability2 syslog;
+allow recovery selinuxfs:file write;
+allow recovery sysfs_io_sched_tuneable:dir { open read search }

Patches/LineageOS-14.1/android_system_core/0001-Harden.patch

@@ -1,4 +1,4 @@
-From 8587a37763a55d6c08974cf0fa96f7eb2a985b25 Mon Sep 17 00:00:00 2001
+From 22342a49f43d2d7613d12603ec99d75dc2ceb6eb Mon Sep 17 00:00:00 2001
 From: Daniel Micay <danielmicay@gmail.com>
 Date: Wed, 28 Jun 2017 07:54:49 -0400
 Subject: [PATCH] Harden
@@ -6,8 +6,8 @@ Subject: [PATCH] Harden
 Change-Id: I46e3fc4ac896a509ab8ca90ae4ce09b820da434b
 ---
  init/init.cpp   | 6 +++---
- rootdir/init.rc | 4 ++++
+ rootdir/init.rc | 8 ++++++++
- 2 files changed, 7 insertions(+), 3 deletions(-)
+ 2 files changed, 11 insertions(+), 3 deletions(-)
 
 diff --git a/init/init.cpp b/init/init.cpp
 index 7a370596e..35bf44a7b 100755
@@ -28,13 +28,17 @@ index 7a370596e..35bf44a7b 100755
  
      // We must have some place other than / to create the device nodes for
 diff --git a/rootdir/init.rc b/rootdir/init.rc
-index 40a36402e..4b323a74c 100644
+index 498203c83..4875ff54b 100644
 --- a/rootdir/init.rc
 +++ b/rootdir/init.rc
-@@ -126,6 +126,10 @@ on init
+@@ -126,6 +126,14 @@ on init
      write /proc/sys/kernel/sched_child_runs_first 0
  
      write /proc/sys/kernel/randomize_va_space 2
++    write /proc/sys/fs/protected_hardlinks 1
++    write /proc/sys/fs/protected_symlinks 1
++    write /proc/sys/fs/protected_fifos 1
++    write /proc/sys/fs/protected_regular 1
 +    write /proc/sys/net/ipv4/tcp_sack 0
 +    write /proc/sys/net/ipv6/conf/all/use_tempaddr 2
 +    write /proc/sys/net/ipv6/conf/default/use_tempaddr 2

Patches/LineageOS-15.1/android_system_core/0001-Harden.patch

@@ -1,4 +1,4 @@
-From 552418bd638628aa0c1a92730d666252c9147bda Mon Sep 17 00:00:00 2001
+From 0ccf36d7c3f43254216fdcdd15c6247403e3ef53 Mon Sep 17 00:00:00 2001
 From: Daniel Micay <danielmicay@gmail.com>
 Date: Mon, 12 Feb 2018 03:29:58 -0500
 Subject: [PATCH] Harden
@@ -6,8 +6,8 @@ Subject: [PATCH] Harden
 Change-Id: Idd2da6d9989ec554ce5b0841781d323fdcd9eb87
 ---
  init/init.cpp   | 6 +++---
- rootdir/init.rc | 4 ++++
+ rootdir/init.rc | 9 +++++++++
- 2 files changed, 7 insertions(+), 3 deletions(-)
+ 2 files changed, 12 insertions(+), 3 deletions(-)
 
 diff --git a/init/init.cpp b/init/init.cpp
 index 35fc442d0..b65686f93 100644
@@ -32,14 +32,19 @@ index 35fc442d0..b65686f93 100644
          mknod("/dev/kmsg", S_IFCHR | 0600, makedev(1, 11));
          mknod("/dev/random", S_IFCHR | 0666, makedev(1, 8));
 diff --git a/rootdir/init.rc b/rootdir/init.rc
-index f9cb4a3ef..2b0dece40 100644
+index f9cb4a3ef..c3cea4eb6 100644
 --- a/rootdir/init.rc
 +++ b/rootdir/init.rc
-@@ -124,6 +124,10 @@ on init
+@@ -124,6 +124,15 @@ on init
      write /proc/sys/kernel/sched_wakeup_granularity_ns 2000000
      write /proc/sys/kernel/sched_child_runs_first 0
  
 +    write /proc/sys/kernel/dmesg_restrict 1
++    write /proc/sys/kernel/kptr_restrict 2
++    write /proc/sys/fs/protected_hardlinks 1
++    write /proc/sys/fs/protected_symlinks 1
++    write /proc/sys/fs/protected_fifos 1
++    write /proc/sys/fs/protected_regular 1
 +    write /proc/sys/net/ipv4/tcp_sack 0
 +    write /proc/sys/net/ipv6/conf/all/use_tempaddr 2
 +    write /proc/sys/net/ipv6/conf/default/use_tempaddr 2

Patches/LineageOS-16.0/android_system_core/0001-Harden.patch

@@ -1,4 +1,4 @@
-From 231f969f0478c572afef5f9eeaaf81922f8e027e Mon Sep 17 00:00:00 2001
+From 7ab11e320c3b3c3338c5b66a5303bcaa074395be Mon Sep 17 00:00:00 2001
 From: Daniel Micay <danielmicay@gmail.com>
 Date: Mon, 12 Feb 2018 03:29:58 -0500
 Subject: [PATCH] Harden
@@ -6,8 +6,8 @@ Subject: [PATCH] Harden
 Change-Id: Idd2da6d9989ec554ce5b0841781d323fdcd9eb87
 ---
  init/init.cpp   | 6 +++---
- rootdir/init.rc | 4 ++++
+ rootdir/init.rc | 9 +++++++++
- 2 files changed, 7 insertions(+), 3 deletions(-)
+ 2 files changed, 12 insertions(+), 3 deletions(-)
 
 diff --git a/init/init.cpp b/init/init.cpp
 index eb9dd755b..504a6d13e 100644
@@ -32,14 +32,19 @@ index eb9dd755b..504a6d13e 100644
  
          mknod("/dev/kmsg", S_IFCHR | 0600, makedev(1, 11));
 diff --git a/rootdir/init.rc b/rootdir/init.rc
-index 4a8a60a96..6e4accdba 100644
+index 4a8a60a96..acd1d06d1 100644
 --- a/rootdir/init.rc
 +++ b/rootdir/init.rc
-@@ -121,6 +121,10 @@ on init
+@@ -121,6 +121,15 @@ on init
      write /proc/sys/kernel/sched_wakeup_granularity_ns 2000000
      write /proc/sys/kernel/sched_child_runs_first 0
  
 +    write /proc/sys/kernel/dmesg_restrict 1
++    write /proc/sys/kernel/kptr_restrict 2
++    write /proc/sys/fs/protected_hardlinks 1
++    write /proc/sys/fs/protected_symlinks 1
++    write /proc/sys/fs/protected_fifos 1
++    write /proc/sys/fs/protected_regular 1
 +    write /proc/sys/net/ipv4/tcp_sack 0
 +    write /proc/sys/net/ipv6/conf/all/use_tempaddr 2
 +    write /proc/sys/net/ipv6/conf/default/use_tempaddr 2

Scripts/Common/Functions.sh

@@ -145,7 +145,7 @@ signRelease() {
 	DEVICE=$1;
 	VERITY=$2;
 
-	DATE=$(date '+%Y%m%d')
+	DATE=$(date -u '+%Y%m%d')
 	KEY_DIR=$DOS_SIGNING_KEYS;
 	PREFIX="lineage_";
 	VERSION=$(echo $DOS_VERSION | cut -f2 -d "-");
@@ -447,7 +447,7 @@ hardenDefconfig() {
 
 	#Enable supported options
 	#Disabled: CONFIG_DEBUG_SG (bootloops - https://patchwork.kernel.org/patch/8989981)
-	declare -a optionsYes=("CONFIG_ARM64_SW_TTBR0_PAN" "CONFIG_BUG" "CONFIG_BUG_ON_DATA_CORRUPTION" "CONFIG_CC_STACKPROTECTOR" "CONFIG_CC_STACKPROTECTOR_STRONG" "CONFIG_STACKPROTECTOR" "CONFIG_STACKPROTECTOR_STRONG" "CONFIG_CPU_SW_DOMAIN_PAN" "CONFIG_DEBUG_CREDENTIALS" "CONFIG_DEBUG_KERNEL" "CONFIG_DEBUG_LIST" "CONFIG_DEBUG_NOTIFIERS" "CONFIG_DEBUG_RODATA" "CONFIG_DEBUG_WX" "CONFIG_FORTIFY_SOURCE" "CONFIG_GCC_PLUGIN_LATENT_ENTROPY" "CONFIG_GCC_PLUGIN_RANDSTRUCT" "CONFIG_GCC_PLUGINS" "CONFIG_GCC_PLUGIN_STRUCTLEAK" "CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL" "CONFIG_HARDENED_USERCOPY" "CONFIG_IO_STRICT_DEVMEM" "CONFIG_KAISER" "CONFIG_LEGACY_VSYSCALL_NONE" "CONFIG_PAGE_POISONING" "CONFIG_PAGE_POISONING_NO_SANITY" "CONFIG_PAGE_POISONING_ZERO" "CONFIG_PAGE_TABLE_ISOLATION" "CONFIG_PANIC_ON_OOPS" "CONFIG_RANDOMIZE_BASE" "CONFIG_REFCOUNT_FULL" "CONFIG_RETPOLINE" "CONFIG_SCHED_STACK_END_CHECK" "CONFIG_SECCOMP" "CONFIG_SECCOMP_FILTER" "CONFIG_SECURITY" "CONFIG_SECURITY_PERF_EVENTS_RESTRICT" "CONFIG_SECURITY_YAMA" "CONFIG_SECURITY_YAMA_STACKED" "CONFIG_SLAB_FREELIST_RANDOM" "CONFIG_SLAB_HARDENED" "CONFIG_SLUB_DEBUG" "CONFIG_STRICT_DEVMEM" "CONFIG_STRICT_KERNEL_RWX" "CONFIG_STRICT_MEMORY_RWX" "CONFIG_SYN_COOKIES" "CONFIG_UNMAP_KERNEL_AT_EL0" "CONFIG_VMAP_STACK" "CONFIG_SECURITY_DMESG_RESTRICT" "CONFIG_SLAB_FREELIST_HARDENED" "CONFIG_GCC_PLUGINS" "CONFIG_GCC_PLUGIN_LATENT_ENTROPY" "CONFIG_GCC_PLUGIN_STRUCTLEAK" "CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL" "CONFIG_GCC_PLUGIN_RANDSTRUCT" "CONFIG_GCC_PLUGIN_RANDSTRUCT_PERFORMANCE" "CONFIG_IPV6_PRIVACY" "CONFIG_HARDEN_BRANCH_PREDICTOR" "CONFIG_IOMMU_API" "CONFIG_IOMMU_SUPPORT" "CONFIG_IOMMU_HELPER" "CONFIG_INTEL_IOMMU_DEFAULT_ON" "CONFIG_ARM_SMMU" "CONFIG_QCOM_IOMMU" "CONFIG_MSM_IOMMU" "CONFIG_MSM_TZ_SMMU" "CONFIG_KGSL_PER_PROCESS_PAGE_TABLE" "CONFIG_MSM_KGSL_MMU_PAGE_FAULT" "CONFIG_IOMMU_PGTABLES_L2" "CONFIG_TEGRA_IOMMU_SMMU" "CONFIG_TEGRA_IOMMU_GART" "CONFIG_MTK_IOMMU" "CONFIG_EXYNOS_IOMMU" "CONFIG_OMAP_IOMMU" "CONFIG_OF_IOMMU" "CONFIG_DM_VERITY" "CONFIG_DM_VERITY_FEC" "CONFIG_DM_ANDROID_VERITY" "CONFIG_MMC_SECDISCARD")
+	declare -a optionsYes=("CONFIG_ARM64_SW_TTBR0_PAN" "CONFIG_BUG" "CONFIG_BUG_ON_DATA_CORRUPTION" "CONFIG_CC_STACKPROTECTOR" "CONFIG_CC_STACKPROTECTOR_STRONG" "CONFIG_STACKPROTECTOR" "CONFIG_STACKPROTECTOR_STRONG" "CONFIG_CPU_SW_DOMAIN_PAN" "CONFIG_DEBUG_CREDENTIALS" "CONFIG_DEBUG_KERNEL" "CONFIG_DEBUG_LIST" "CONFIG_DEBUG_NOTIFIERS" "CONFIG_DEBUG_RODATA" "CONFIG_DEBUG_WX" "CONFIG_FORTIFY_SOURCE" "CONFIG_GCC_PLUGIN_LATENT_ENTROPY" "CONFIG_GCC_PLUGIN_RANDSTRUCT" "CONFIG_GCC_PLUGINS" "CONFIG_GCC_PLUGIN_STRUCTLEAK" "CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL" "CONFIG_HARDENED_USERCOPY" "CONFIG_IO_STRICT_DEVMEM" "CONFIG_KAISER" "CONFIG_LEGACY_VSYSCALL_NONE" "CONFIG_PAGE_POISONING" "CONFIG_PAGE_POISONING_NO_SANITY" "CONFIG_PAGE_POISONING_ZERO" "CONFIG_PAGE_TABLE_ISOLATION" "CONFIG_PANIC_ON_OOPS" "CONFIG_RANDOMIZE_BASE" "CONFIG_REFCOUNT_FULL" "CONFIG_RETPOLINE" "CONFIG_SCHED_STACK_END_CHECK" "CONFIG_SECCOMP" "CONFIG_SECCOMP_FILTER" "CONFIG_SECURITY" "CONFIG_SECURITY_PERF_EVENTS_RESTRICT" "CONFIG_SECURITY_YAMA" "CONFIG_SECURITY_YAMA_STACKED" "CONFIG_SLAB_FREELIST_RANDOM" "CONFIG_SLAB_HARDENED" "CONFIG_SLUB_DEBUG" "CONFIG_STRICT_DEVMEM" "CONFIG_STRICT_KERNEL_RWX" "CONFIG_STRICT_MEMORY_RWX" "CONFIG_SYN_COOKIES" "CONFIG_UNMAP_KERNEL_AT_EL0" "CONFIG_VMAP_STACK" "CONFIG_SECURITY_DMESG_RESTRICT" "CONFIG_SLAB_FREELIST_HARDENED" "CONFIG_GCC_PLUGINS" "CONFIG_GCC_PLUGIN_LATENT_ENTROPY" "CONFIG_GCC_PLUGIN_STRUCTLEAK" "CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL" "CONFIG_GCC_PLUGIN_RANDSTRUCT" "CONFIG_GCC_PLUGIN_RANDSTRUCT_PERFORMANCE" "CONFIG_IPV6_PRIVACY" "CONFIG_HARDEN_BRANCH_PREDICTOR" "CONFIG_IOMMU_API" "CONFIG_IOMMU_SUPPORT" "CONFIG_IOMMU_HELPER" "CONFIG_INTEL_IOMMU_DEFAULT_ON" "CONFIG_ARM_SMMU" "CONFIG_QCOM_IOMMU" "CONFIG_MSM_IOMMU" "CONFIG_MSM_TZ_SMMU" "CONFIG_KGSL_PER_PROCESS_PAGE_TABLE" "CONFIG_MSM_KGSL_MMU_PAGE_FAULT" "CONFIG_IOMMU_PGTABLES_L2" "CONFIG_TEGRA_IOMMU_SMMU" "CONFIG_TEGRA_IOMMU_GART" "CONFIG_MTK_IOMMU" "CONFIG_EXYNOS_IOMMU" "CONFIG_OMAP_IOMMU" "CONFIG_OF_IOMMU" "CONFIG_DM_VERITY" "CONFIG_DM_VERITY_FEC" "CONFIG_DM_ANDROID_VERITY" "CONFIG_ASYMMETRIC_KEY_TYPE" "CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE" "CONFIG_X509_CERTIFICATE_PARSER" "CONFIG_PKCS7_MESSAGE_PARSER" "CONFIG_SYSTEM_TRUSTED_KEYRING" "CONFIG_MMC_SECDISCARD")
 	#if [ "$DOS_DEBLOBBER_REPLACE_TIME" = true ]; then optionsYes+=("CONFIG_RTC_DRV_MSM" "CONFIG_RTC_DRV_PM8XXX" "CONFIG_RTC_DRV_MSM7X00A" "CONFIG_RTC_DRV_QPNP"); fi;
 	for option in "${optionsYes[@]}"
 	do

Scripts/LineageOS-11.0/Functions.sh

@@ -41,7 +41,6 @@ export -f buildDevice;
 
 buildDeviceDebug() {
 	unset SIGNING_KEY_DIR;
-	unset OTA_PACKAGE_SIGNING_KEY;
 	brunch "cm_$1-eng";
 }
 export -f buildDeviceDebug;

Scripts/LineageOS-14.1/Functions.sh

@@ -41,7 +41,6 @@ export -f buildDevice;
 
 buildDeviceDebug() {
 	unset SIGNING_KEY_DIR;
-	unset OTA_PACKAGE_SIGNING_KEY;
 	brunch "lineage_$1-eng";
 }
 export -f buildDeviceDebug;

Scripts/LineageOS-14.1/Patch.sh

@@ -262,7 +262,6 @@ find "device" -maxdepth 2 -mindepth 2 -type d -print0 | xargs -0 -n 1 -P 8 -I {}
 find "device" -maxdepth 2 -mindepth 2 -type d -print0 | xargs -0 -n 1 -P 8 -I {} bash -c 'hardenUserdata "{}"';
 if [ "$DOS_STRONG_ENCRYPTION_ENABLED" = true ]; then find "device" -maxdepth 2 -mindepth 2 -type d -print0 | xargs -0 -n 1 -P 8 -I {} bash -c 'enableStrongEncryption "{}"'; fi;
 find "kernel" -maxdepth 2 -mindepth 2 -type d -print0 | xargs -0 -n 1 -P 4 -I {} bash -c 'hardenDefconfig "{}"';
-#find "kernel" -maxdepth 3 -mindepth 2 -name "verifiedboot*.x509" -type f -print0 | xargs -0 -n 1 -P 8 -I {} bash -c 'cp "$DOS_SIGNING_KEYS/verifiedboot_relkeys.der.x509" "{}"'; #"veri*keys.der.x509"
 find "kernel" -maxdepth 2 -mindepth 2 -type d -print0 | xargs -0 -n 1 -P 8 -I {} bash -c 'cp "$DOS_SIGNING_KEYS/verifiedboot_relkeys.der.x509" "{}/verifiedboot_divested_relkeys.der.x509"';
 cd "$DOS_BUILD_BASE";
 

Scripts/LineageOS-15.1/Functions.sh

@@ -41,7 +41,6 @@ export -f buildDevice;
 
 buildDeviceDebug() {
 	unset SIGNING_KEY_DIR;
-	unset OTA_PACKAGE_SIGNING_KEY;
 	brunch "lineage_$1-eng";
 }
 export -f buildDeviceDebug;

Scripts/LineageOS-15.1/Patch.sh

@@ -66,7 +66,7 @@ enterAndClear "bionic";
 if [ "$DOS_GRAPHENE_MALLOC" = true ]; then patch -p1 < "$DOS_PATCHES/android_bionic/0001-HM-Use_HM.patch"; fi;
 
 enterAndClear "bootable/recovery";
-git revert ac258a4f4c4b4b91640cc477ad1ac125f206db02; #Resurrect dm-verity
+#git revert ac258a4f4c4b4b91640cc477ad1ac125f206db02; #Resurrect dm-verity
 
 enterAndClear "build/make";
 sed -i '57i$(my_res_package): PRIVATE_AAPT_FLAGS += --auto-add-overlay' core/aapt2.mk;
@@ -91,7 +91,7 @@ sed -i 's/DEFAULT_MAX_FILES = 1000;/DEFAULT_MAX_FILES = 0;/' services/core/java/
 sed -i 's/DEFAULT_MAX_FILES_LOWRAM = 300;/DEFAULT_MAX_FILES_LOWRAM = 0;/' services/core/java/com/android/server/DropBoxManagerService.java; #Disable DropBox
 sed -i 's/(notif.needNotify)/(true)/' location/java/com/android/internal/location/GpsNetInitiatedHandler.java; #Notify user when location is requested via SUPL
 sed -i 's/entry == null/entry == null || true/' core/java/android/os/RecoverySystem.java; #Skip update compatibiltity check XXX: TEMPORARY FIX
-sed -i 's/!Build.isBuildConsistent()/false/' services/core/java/com/android/server/am/ActivityManagerService.java; #Disable fingerprint mismatch warning XXX: TEMPORARY FIX
+#sed -i 's/!Build.isBuildConsistent()/false/' services/core/java/com/android/server/am/ActivityManagerService.java; #Disable fingerprint mismatch warning XXX: TEMPORARY FIX
 if [ "$DOS_MICROG_INCLUDED" = "FULL" ]; then patch -p1 < "$DOS_PATCHES/android_frameworks_base/0002-Signature_Spoofing.patch"; fi; #Allow packages to spoof their signature (microG)
 if [ "$DOS_MICROG_INCLUDED" = "FULL" ]; then patch -p1 < "$DOS_PATCHES/android_frameworks_base/0003-Harden_Sig_Spoofing.patch"; fi; #Restrict signature spoofing to system apps signed with the platform key
 changeDefaultDNS;
@@ -228,7 +228,6 @@ find "device" -maxdepth 2 -mindepth 2 -type d -print0 | xargs -0 -n 1 -P 8 -I {}
 find "device" -maxdepth 2 -mindepth 2 -type d -print0 | xargs -0 -n 1 -P 8 -I {} bash -c 'hardenUserdata "{}"';
 if [ "$DOS_STRONG_ENCRYPTION_ENABLED" = true ]; then find "device" -maxdepth 2 -mindepth 2 -type d -print0 | xargs -0 -n 1 -P 8 -I {} bash -c 'enableStrongEncryption "{}"'; fi;
 find "kernel" -maxdepth 2 -mindepth 2 -type d -print0 | xargs -0 -n 1 -P 4 -I {} bash -c 'hardenDefconfig "{}"';
-#find "kernel" -maxdepth 3 -mindepth 2 -name "verifiedboot*.x509" -type f -print0 | xargs -0 -n 1 -P 8 -I {} bash -c 'cp "$DOS_SIGNING_KEYS/verifiedboot_relkeys.der.x509" "{}"'; #"veri*keys.der.x509"
 find "kernel" -maxdepth 2 -mindepth 2 -type d -print0 | xargs -0 -n 1 -P 8 -I {} bash -c 'cp "$DOS_SIGNING_KEYS/verifiedboot_relkeys.der.x509" "{}/verifiedboot_divested_relkeys.der.x509"';
 cd "$DOS_BUILD_BASE";
 

Scripts/LineageOS-16.0/Functions.sh

@@ -41,7 +41,6 @@ export -f buildDevice;
 
 buildDeviceDebug() {
 	unset SIGNING_KEY_DIR;
-	unset OTA_PACKAGE_SIGNING_KEY;
 	brunch "lineage_$1-eng";
 }
 export -f buildDeviceDebug;

Scripts/LineageOS-16.0/Patch.sh

@@ -66,7 +66,7 @@ enterAndClear "bionic";
 if [ "$DOS_GRAPHENE_MALLOC" = true ]; then patch -p1 < "$DOS_PATCHES/android_bionic/0001-HM-Use_HM.patch"; fi;
 
 enterAndClear "bootable/recovery";
-git revert fe2901b144c515c5a90b547198aed37c209b5a82; #Resurrect dm-verity
+#git revert fe2901b144c515c5a90b547198aed37c209b5a82; #Resurrect dm-verity
 
 enterAndClear "build/make";
 git revert 271f6ffa045064abcac066e97f2cb53ccb3e5126 61f7ee9386be426fd4eadc2c8759362edb5bef8; #Add back PicoTTS and language files
@@ -91,7 +91,7 @@ sed -i 's/DEFAULT_MAX_FILES = 1000;/DEFAULT_MAX_FILES = 0;/' services/core/java/
 sed -i 's/DEFAULT_MAX_FILES_LOWRAM = 300;/DEFAULT_MAX_FILES_LOWRAM = 0;/' services/core/java/com/android/server/DropBoxManagerService.java; #Disable DropBox
 sed -i 's/(notif.needNotify)/(true)/' location/java/com/android/internal/location/GpsNetInitiatedHandler.java; #Notify user when location is requested via SUPL
 sed -i 's/entry == null/entry == null || true/' core/java/android/os/RecoverySystem.java; #Skip update compatibiltity check XXX: TEMPORARY FIX
-sed -i 's/!Build.isBuildConsistent()/false/' services/core/java/com/android/server/am/ActivityManagerService.java; #Disable fingerprint mismatch warning XXX: TEMPORARY FIX
+#sed -i 's/!Build.isBuildConsistent()/false/' services/core/java/com/android/server/am/ActivityManagerService.java; #Disable fingerprint mismatch warning XXX: TEMPORARY FIX
 if [ "$DOS_MICROG_INCLUDED" = "FULL" ]; then patch -p1 < "$DOS_PATCHES/android_frameworks_base/0002-Signature_Spoofing.patch"; fi; #Allow packages to spoof their signature (microG)
 if [ "$DOS_MICROG_INCLUDED" = "FULL" ]; then patch -p1 < "$DOS_PATCHES/android_frameworks_base/0003-Harden_Sig_Spoofing.patch"; fi; #Restrict signature spoofing to system apps signed with the platform key
 changeDefaultDNS;
@@ -237,7 +237,6 @@ find "device" -maxdepth 2 -mindepth 2 -type d -print0 | xargs -0 -n 1 -P 8 -I {}
 find "device" -maxdepth 2 -mindepth 2 -type d -print0 | xargs -0 -n 1 -P 8 -I {} bash -c 'hardenUserdata "{}"';
 if [ "$DOS_STRONG_ENCRYPTION_ENABLED" = true ]; then find "device" -maxdepth 2 -mindepth 2 -type d -print0 | xargs -0 -n 1 -P 8 -I {} bash -c 'enableStrongEncryption "{}"'; fi;
 find "kernel" -maxdepth 2 -mindepth 2 -type d -print0 | xargs -0 -n 1 -P 4 -I {} bash -c 'hardenDefconfig "{}"';
-#find "kernel" -maxdepth 3 -mindepth 2 -name "verifiedboot*.x509" -type f -print0 | xargs -0 -n 1 -P 8 -I {} bash -c 'cp "$DOS_SIGNING_KEYS/verifiedboot_relkeys.der.x509" "{}"'; #"veri*keys.der.x509"
 find "kernel" -maxdepth 2 -mindepth 2 -type d -print0 | xargs -0 -n 1 -P 8 -I {} bash -c 'cp "$DOS_SIGNING_KEYS/verifiedboot_relkeys.der.x509" "{}/verifiedboot_divested_relkeys.der.x509"';
 cd "$DOS_BUILD_BASE";