Git-Mirrors/DivestOS
1
0
Fork 0
mirror of https://github.com/Divested-Mobile/DivestOS-Build.git synced 2024-12-25 15:39:26 -05:00
Code Issues Packages Projects Releases Wiki Activity

Cleanup

Browse Source
This commit is contained in:
Tad 2018-06-13 19:48:53 -04:00
parent e259807d44
commit 79aa32c5e2
6 changed files with 14 additions and 87 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
Manifests/Manifest_LAOS-15.1.xml
View File

@ -130,10 +130,6 @@
<project path="device/lge/msm8996-common" name="LineageOS/android_device_lge_msm8996-common" remote="github" /> <project path="device/lge/msm8996-common" name="LineageOS/android_device_lge_msm8996-common" remote="github" />
<project path="kernel/lge/msm8996" name="LineageOS/android_kernel_lge_msm8996" remote="github" /> <project path="kernel/lge/msm8996" name="LineageOS/android_kernel_lge_msm8996" remote="github" />
<!-- Moto X Pure Edition (clark) -->
<project path="device/motorola/clark" name="hashbang173/android_device_motorola_clark" remote="github" />
<project path="kernel/motorola/msm8992" name="hashbang173/android_kernel_motorola_msm8992" remote="github" />
<!-- Moto Z (griffin) --> <!-- Moto Z (griffin) -->
<project path="device/motorola/griffin" name="LineageOS/android_device_motorola_griffin" remote="github" /> <project path="device/motorola/griffin" name="LineageOS/android_device_motorola_griffin" remote="github" />
<project path="kernel/motorola/msm8996" name="LineageOS/android_kernel_motorola_msm8996" remote="github" /> <project path="kernel/motorola/msm8996" name="LineageOS/android_kernel_motorola_msm8996" remote="github" />

15
Scripts/Common/Functions.sh
View File

@ -87,6 +87,17 @@ scanForMalware() {
} }
export -f scanForMalware; export -f scanForMalware;
audit2allowCurrent() {
adb shell dmesg | grep denied | audit2allow -p "$ANDROID_PRODUCT_OUT"/root/sepolicy;
}
export -f audit2allowCurrent;
audit2allowADB() {
adb pull /sys/fs/selinux/policy;
adb logcat -b all -d | audit2allow -p policy;
}
export -f audit2allowADB;
disableDexPreOpt() { disableDexPreOpt() {
cd $base$1; cd $base$1;
if [ -f BoardConfig.mk ]; then if [ -f BoardConfig.mk ]; then
@ -190,7 +201,7 @@ hardenDefconfig() {
#Enable supported options #Enable supported options
#Disabled: CONFIG_DEBUG_SG (bootloops - https://patchwork.kernel.org/patch/8989981) #Disabled: CONFIG_DEBUG_SG (bootloops - https://patchwork.kernel.org/patch/8989981)
declare -a optionsYes=("CONFIG_ARM64_SW_TTBR0_PAN" "CONFIG_BUG" "CONFIG_BUG_ON_DATA_CORRUPTION" "CONFIG_CC_STACKPROTECTOR" "CONFIG_CC_STACKPROTECTOR_STRONG" "CONFIG_CPU_SW_DOMAIN_PAN" "CONFIG_DEBUG_CREDENTIALS" "CONFIG_DEBUG_KERNEL" "CONFIG_DEBUG_LIST" "CONFIG_DEBUG_NOTIFIERS" "CONFIG_DEBUG_RODATA" "CONFIG_DEBUG_WX" "CONFIG_FORTIFY_SOURCE" "CONFIG_GCC_PLUGIN_LATENT_ENTROPY" "CONFIG_GCC_PLUGIN_RANDSTRUCT" "CONFIG_GCC_PLUGINS" "CONFIG_GCC_PLUGIN_STRUCTLEAK" "CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL" "CONFIG_HARDENED_USERCOPY" "CONFIG_IO_STRICT_DEVMEM" "CONFIG_KAISER" "CONFIG_LEGACY_VSYSCALL_NONE" "CONFIG_PAGE_POISONING" "CONFIG_PAGE_POISONING_NO_SANITY" "CONFIG_PAGE_POISONING_ZERO" "CONFIG_PAGE_TABLE_ISOLATION" "CONFIG_PANIC_ON_OOPS" "CONFIG_RANDOMIZE_BASE" "CONFIG_REFCOUNT_FULL" "CONFIG_RETPOLINE" "CONFIG_SCHED_STACK_END_CHECK" "CONFIG_SECCOMP" "CONFIG_SECCOMP_FILTER" "CONFIG_SECURITY" "CONFIG_SECURITY_PERF_EVENTS_RESTRICT" "CONFIG_SECURITY_YAMA" "CONFIG_SECURITY_YAMA_STACKED" "CONFIG_SLAB_FREELIST_RANDOM" "CONFIG_SLAB_HARDENED" "CONFIG_SLUB_DEBUG" "CONFIG_STRICT_DEVMEM" "CONFIG_STRICT_KERNEL_RWX" "CONFIG_STRICT_MEMORY_RWX" "CONFIG_SYN_COOKIES" "CONFIG_UNMAP_KERNEL_AT_EL0" "CONFIG_VMAP_STACK" "CONFIG_SECURITY_DMESG_RESTRICT" "CONFIG_SLAB_FREELIST_HARDENED" "CONFIG_GCC_PLUGINS" "CONFIG_GCC_PLUGIN_LATENT_ENTROPY" "CONFIG_GCC_PLUGIN_STRUCTLEAK" "CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL" "CONFIG_GCC_PLUGIN_RANDSTRUCT" "CONFIG_GCC_PLUGIN_RANDSTRUCT_PERFORMANCE" "CONFIG_PARTIALRESUME" "CONFIG_CRYPTO_PCRYPT" "CONFIG_CRYPTO_CRYPTD" "CONFIG_CRYPTO_DEV_QCRYPTO" "CONFIG_CRYPTO_AES_ARM" "CONFIG_CRYPTO_AES_ARM_BS") declare -a optionsYes=("CONFIG_ARM64_SW_TTBR0_PAN" "CONFIG_BUG" "CONFIG_BUG_ON_DATA_CORRUPTION" "CONFIG_CC_STACKPROTECTOR" "CONFIG_CC_STACKPROTECTOR_STRONG" "CONFIG_CPU_SW_DOMAIN_PAN" "CONFIG_DEBUG_CREDENTIALS" "CONFIG_DEBUG_KERNEL" "CONFIG_DEBUG_LIST" "CONFIG_DEBUG_NOTIFIERS" "CONFIG_DEBUG_RODATA" "CONFIG_DEBUG_WX" "CONFIG_FORTIFY_SOURCE" "CONFIG_GCC_PLUGIN_LATENT_ENTROPY" "CONFIG_GCC_PLUGIN_RANDSTRUCT" "CONFIG_GCC_PLUGINS" "CONFIG_GCC_PLUGIN_STRUCTLEAK" "CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL" "CONFIG_HARDENED_USERCOPY" "CONFIG_IO_STRICT_DEVMEM" "CONFIG_KAISER" "CONFIG_LEGACY_VSYSCALL_NONE" "CONFIG_PAGE_POISONING" "CONFIG_PAGE_POISONING_NO_SANITY" "CONFIG_PAGE_POISONING_ZERO" "CONFIG_PAGE_TABLE_ISOLATION" "CONFIG_PANIC_ON_OOPS" "CONFIG_RANDOMIZE_BASE" "CONFIG_REFCOUNT_FULL" "CONFIG_RETPOLINE" "CONFIG_SCHED_STACK_END_CHECK" "CONFIG_SECCOMP" "CONFIG_SECCOMP_FILTER" "CONFIG_SECURITY" "CONFIG_SECURITY_PERF_EVENTS_RESTRICT" "CONFIG_SECURITY_YAMA" "CONFIG_SECURITY_YAMA_STACKED" "CONFIG_SLAB_FREELIST_RANDOM" "CONFIG_SLAB_HARDENED" "CONFIG_SLUB_DEBUG" "CONFIG_STRICT_DEVMEM" "CONFIG_STRICT_KERNEL_RWX" "CONFIG_STRICT_MEMORY_RWX" "CONFIG_SYN_COOKIES" "CONFIG_UNMAP_KERNEL_AT_EL0" "CONFIG_VMAP_STACK" "CONFIG_SECURITY_DMESG_RESTRICT" "CONFIG_SLAB_FREELIST_HARDENED" "CONFIG_GCC_PLUGINS" "CONFIG_GCC_PLUGIN_LATENT_ENTROPY" "CONFIG_GCC_PLUGIN_STRUCTLEAK" "CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL" "CONFIG_GCC_PLUGIN_RANDSTRUCT" "CONFIG_GCC_PLUGIN_RANDSTRUCT_PERFORMANCE")
for option in "${optionsYes[@]}" for option in "${optionsYes[@]}"
do do
sed -i 's/# '$option' is not set/'$option'=y/' $defconfigPath &>/dev/null || true; sed -i 's/# '$option' is not set/'$option'=y/' $defconfigPath &>/dev/null || true;
@ -203,7 +214,7 @@ hardenDefconfig() {
done done
#Disable supported options #Disable supported options
#TODO: Disable earjack/uart debugger #TODO: Disable earjack/uart debugger
declare -a optionsNo=("CONFIG_ACPI_CUSTOM_METHOD" "CONFIG_BINFMT_MISC" "CONFIG_COMPAT_BRK" "CONFIG_COMPAT_VDSO" "CONFIG_CP_ACCESS64" "CONFIG_DEVKMEM" "CONFIG_DEVMEM" "CONFIG_DEVPORT" "CONFIG_HIBERNATION" "CONFIG_INET_DIAG" "CONFIG_KEXEC" "CONFIG_LEGACY_PTYS" "CONFIG_MSM_BUSPM_DEV" "CONFIG_OABI_COMPAT" "CONFIG_PROC_KCORE" "CONFIG_PROC_VMCORE" "CONFIG_SECURITY_SELINUX_DISABLE" "CONFIG_SLAB_MERGE_DEFAULT" "CONFIG_WLAN_FEATURE_MEMDUMP" "CONFIG_CRYPTO_DEV_QCEDEV" "CONFIG_CRYPTO_DEV_OTA_CRYPTO") declare -a optionsNo=("CONFIG_ACPI_CUSTOM_METHOD" "CONFIG_BINFMT_MISC" "CONFIG_COMPAT_BRK" "CONFIG_COMPAT_VDSO" "CONFIG_CP_ACCESS64" "CONFIG_DEVKMEM" "CONFIG_DEVMEM" "CONFIG_DEVPORT" "CONFIG_HIBERNATION" "CONFIG_INET_DIAG" "CONFIG_KEXEC" "CONFIG_LEGACY_PTYS" "CONFIG_MSM_BUSPM_DEV" "CONFIG_OABI_COMPAT" "CONFIG_PROC_KCORE" "CONFIG_PROC_VMCORE" "CONFIG_SECURITY_SELINUX_DISABLE" "CONFIG_SLAB_MERGE_DEFAULT" "CONFIG_WLAN_FEATURE_MEMDUMP")
for option in "${optionsNo[@]}" for option in "${optionsNo[@]}"
do do
sed -i 's/'$option'=y/# '$option' is not set/' $defconfigPath &>/dev/null || true; sed -i 's/'$option'=y/# '$option' is not set/' $defconfigPath &>/dev/null || true;

2
Scripts/LineageOS-14.1/Patch.sh
View File

@ -236,8 +236,6 @@ cd $base;
#Fixes #Fixes
#Fix broken options enabled by hardenDefconfig() #Fix broken options enabled by hardenDefconfig()
sed -i "s/CONFIG_STRICT_MEMORY_RWX=y/# CONFIG_STRICT_MEMORY_RWX is not set/" kernel/lge/msm8996/arch/arm64/configs/lineageos_*_defconfig; #Breaks on compile sed -i "s/CONFIG_STRICT_MEMORY_RWX=y/# CONFIG_STRICT_MEMORY_RWX is not set/" kernel/lge/msm8996/arch/arm64/configs/lineageos_*_defconfig; #Breaks on compile
sed -i "s/CONFIG_PARTIALRESUME=y/# CONFIG_PARTIALRESUME is not set/" kernel/motorola/msm8992/arch/arm64/configs/*defconfig; #Breaks on compile
sed -i "s/CONFIG_CRYPTO_DEV_QCRYPTO=y/# CONFIG_CRYPTO_DEV_QCRYPTO is not set/" kernel/samsung/jf/arch/arm/configs/lineageos_*_defconfig; #Breaks on compile
# #
#END OF DEVICE CHANGES #END OF DEVICE CHANGES
# #

76
Scripts/LineageOS-15.1/CVE_Patchers/android_kernel_motorola_msm8992.sh
View File

@ -1,76 +0,0 @@
#!/bin/bash
cd $base"kernel/motorola/msm8992"
git apply $cvePatchesLinux/0007-Copperhead-Kernel_Hardening/3.10/0004-No_dir-relax.patch
git apply $cvePatchesLinux/0007-Copperhead-Kernel_Hardening/3.10/0005.patch
git apply $cvePatchesLinux/0007-Copperhead-Kernel_Hardening/3.10/0006.patch
git apply $cvePatchesLinux/0007-Copperhead-Kernel_Hardening/3.10/0007.patch
git apply $cvePatchesLinux/0007-Copperhead-Kernel_Hardening/3.10/0008.patch
git apply $cvePatchesLinux/0007-Copperhead-Kernel_Hardening/3.10/0009.patch
git apply $cvePatchesLinux/0007-Copperhead-Kernel_Hardening/3.10/0010.patch
git apply $cvePatchesLinux/0007-Copperhead-Kernel_Hardening/3.10/0011.patch
git apply $cvePatchesLinux/0007-Copperhead-Kernel_Hardening/3.10/0013.patch
git apply $cvePatchesLinux/0007-Copperhead-Kernel_Hardening/3.10/0014.patch
git apply $cvePatchesLinux/0007-Copperhead-Kernel_Hardening/3.10/0015.patch
git apply $cvePatchesLinux/0007-Copperhead-Kernel_Hardening/3.10/0016.patch
git apply $cvePatchesLinux/0007-Copperhead-Kernel_Hardening/3.10/0017.patch
git apply $cvePatchesLinux/0007-Copperhead-Kernel_Hardening/3.10/0018.patch
git apply $cvePatchesLinux/0007-Copperhead-Kernel_Hardening/ANY/0001.patch
git apply $cvePatchesLinux/0010-Accelerated_AES/3.10+/0011.patch
git apply $cvePatchesLinux/0010-Accelerated_AES/3.10+/0012.patch
git apply $cvePatchesLinux/CVE-2014-9904/ANY/0001.patch
git apply $cvePatchesLinux/CVE-2016-6672/ANY/0001.patch
git apply $cvePatchesLinux/CVE-2016-6693/ANY/0001.patch
git apply $cvePatchesLinux/CVE-2016-6696/ANY/0001.patch
git apply $cvePatchesLinux/CVE-2016-8394/ANY/0001.patch
git apply $cvePatchesLinux/CVE-2017-0648/ANY/0001.patch
git apply $cvePatchesLinux/CVE-2017-0750/ANY/0001.patch
git apply $cvePatchesLinux/CVE-2017-0861/3.10/0001.patch
git apply $cvePatchesLinux/CVE-2017-0862/3.10/0001.patch
git apply $cvePatchesLinux/CVE-2017-1000410/ANY/0001.patch
git apply $cvePatchesLinux/CVE-2017-11473/ANY/0001.patch
git apply $cvePatchesLinux/CVE-2017-11600/3.10/0001.patch
git apply $cvePatchesLinux/CVE-2017-13163/3.10/0001.patch
git apply $cvePatchesLinux/CVE-2017-13168/3.10/0001.patch
git apply $cvePatchesLinux/CVE-2017-13216/3.10/0001.patch
git apply $cvePatchesLinux/CVE-2017-13218/3.10/0001.patch
git apply $cvePatchesLinux/CVE-2017-13218/3.10/0002.patch
git apply $cvePatchesLinux/CVE-2017-13218/3.10/0003.patch
git apply $cvePatchesLinux/CVE-2017-13218/3.10/0004.patch
git apply $cvePatchesLinux/CVE-2017-13245/ANY/0001.patch
git apply $cvePatchesLinux/CVE-2017-13246/ANY/0001.patch
git apply $cvePatchesLinux/CVE-2017-16526/^4.13/0001.patch
git apply $cvePatchesLinux/CVE-2017-16531/^4.13/0001.patch
git apply $cvePatchesLinux/CVE-2017-16532/^4.13/0001.patch
git apply $cvePatchesLinux/CVE-2017-16533/^4.13/0001.patch
git apply $cvePatchesLinux/CVE-2017-16534/ANY/0001.patch
git apply $cvePatchesLinux/CVE-2017-16535/^4.13/0001.patch
git apply $cvePatchesLinux/CVE-2017-16537/^4.13/0001.patch
git apply $cvePatchesLinux/CVE-2017-16538/^4.13/0001.patch
git apply $cvePatchesLinux/CVE-2017-16538/^4.13/0002.patch
git apply $cvePatchesLinux/CVE-2017-16643/3.5+/0001.patch
git apply $cvePatchesLinux/CVE-2017-16645/ANY/0001.patch
git apply $cvePatchesLinux/CVE-2017-16650/ANY/0001.patch
git apply $cvePatchesLinux/CVE-2017-16939/3.10/0001.patch
git apply $cvePatchesLinux/CVE-2017-16USB/ANY/0001.patch
git apply $cvePatchesLinux/CVE-2017-16USB/ANY/0003.patch
git apply $cvePatchesLinux/CVE-2017-16USB/ANY/0006.patch
git apply $cvePatchesLinux/CVE-2017-17558/ANY/0001.patch
git apply $cvePatchesLinux/CVE-2017-17762/ANY/0001.patch
git apply $cvePatchesLinux/CVE-2017-17806/ANY/0001.patch
git apply $cvePatchesLinux/CVE-2017-6345/^4.9/0001.patch
git apply $cvePatchesLinux/CVE-2017-7533/3.10/0002.patch
git apply $cvePatchesLinux/CVE-2017-7533/3.10/0003.patch
git apply $cvePatchesLinux/CVE-2017-8243/3.10/0001.patch
git apply $cvePatchesLinux/CVE-2017-8281/3.10/0001.patch
git apply $cvePatchesLinux/CVE-2017-8281/3.10/0003.patch
git apply $cvePatchesLinux/CVE-2017-9723/ANY/0001.patch
git apply $cvePatchesLinux/CVE-2018-3563/3.10/0001.patch
git apply $cvePatchesLinux/CVE-2018-3584/ANY/0001.patch
#git apply $cvePatchesLinux/CVE-2018-3585/3.10/0001.patch
git apply $cvePatchesLinux/CVE-2018-5825/3.10/0001.patch
git apply $cvePatchesLinux/LVT-2017-0003/3.10/0001.patch
git apply $cvePatchesLinux/CVE-2016-6693/ANY/0001.patch
git apply $cvePatchesLinux/CVE-2016-6696/ANY/0001.patch
git apply $cvePatchesLinux/CVE-2017-0750/ANY/0001.patch
editKernelLocalversion "-dos.p72"
cd $base

3
Scripts/LineageOS-15.1/Functions.sh
View File

@ -18,7 +18,7 @@
#Last verified: 2018-04-27 #Last verified: 2018-04-27
patchAllKernels() { patchAllKernels() {
startPatcher "kernel_google_marlin kernel_google_msm kernel_htc_flounder kernel_htc_msm8974 kernel_huawei_angler kernel_lge_bullhead kernel_lge_g3 kernel_lge_hammerhead kernel_lge_mako kernel_lge_msm8974 kernel_lge_msm8996 kernel_moto_shamu kernel_motorola_msm8992 kernel_motorola_msm8996 kernel_nextbit_msm8992 kernel_oppo_msm8974 kernel_samsung_msm8974"; startPatcher "kernel_google_marlin kernel_google_msm kernel_htc_flounder kernel_htc_msm8974 kernel_huawei_angler kernel_lge_bullhead kernel_lge_g3 kernel_lge_hammerhead kernel_lge_mako kernel_lge_msm8974 kernel_lge_msm8996 kernel_moto_shamu kernel_motorola_msm8996 kernel_nextbit_msm8992 kernel_oppo_msm8974 kernel_samsung_msm8974";
} }
export -f patchAllKernels; export -f patchAllKernels;
@ -53,7 +53,6 @@ buildAll() {
brunch lineage_d852-user; brunch lineage_d852-user;
brunch lineage_bacon-user; brunch lineage_bacon-user;
brunch lineage_mako-user; brunch lineage_mako-user;
#brunch lineage_clark-user; #requires blobs from https://androidfilehost.com/?w=files&flid=244563 and permissive and broken
brunch lineage_angler-user; brunch lineage_angler-user;
brunch lineage_bullhead-user; brunch lineage_bullhead-user;
brunch lineage_d802-user; #broken upstream - error: 'vendor/lge/g2-common/proprietary/vendor/etc/acdbdata/Bluetooth_cal.acdb' brunch lineage_d802-user; #broken upstream - error: 'vendor/lge/g2-common/proprietary/vendor/etc/acdbdata/Bluetooth_cal.acdb'

1
Scripts/LineageOS-15.1/Patch.sh
View File

@ -238,7 +238,6 @@ cd $base;
#Fix broken options enabled by hardenDefconfig() #Fix broken options enabled by hardenDefconfig()
sed -i "s/CONFIG_DEBUG_RODATA=y/# CONFIG_DEBUG_RODATA is not set/" kernel/google/msm/arch/arm/configs/lineageos_*_defconfig; #Breaks on compile sed -i "s/CONFIG_DEBUG_RODATA=y/# CONFIG_DEBUG_RODATA is not set/" kernel/google/msm/arch/arm/configs/lineageos_*_defconfig; #Breaks on compile
sed -i "s/CONFIG_CRYPTO_DEV_QCRYPTO=y/# CONFIG_CRYPTO_DEV_QCRYPTO is not set/" kernel/google/msm/arch/arm/configs/lineageos_*_defconfig; #Breaks on compile
sed -i "s/CONFIG_STRICT_MEMORY_RWX=y/# CONFIG_STRICT_MEMORY_RWX is not set/" kernel/lge/msm8996/arch/arm64/configs/lineageos_*_defconfig; #Breaks on compile sed -i "s/CONFIG_STRICT_MEMORY_RWX=y/# CONFIG_STRICT_MEMORY_RWX is not set/" kernel/lge/msm8996/arch/arm64/configs/lineageos_*_defconfig; #Breaks on compile
sed -i "s/CONFIG_STRICT_MEMORY_RWX=y/# CONFIG_STRICT_MEMORY_RWX is not set/" kernel/motorola/msm8996/arch/arm64/configs/*_defconfig; #Breaks on compile sed -i "s/CONFIG_STRICT_MEMORY_RWX=y/# CONFIG_STRICT_MEMORY_RWX is not set/" kernel/motorola/msm8996/arch/arm64/configs/*_defconfig; #Breaks on compile
# #