Git-Mirrors/DivestOS
1
0
Fork 0
mirror of https://github.com/Divested-Mobile/DivestOS-Build.git synced 2025-08-06 13:24:19 -04:00
Code Issues Projects Releases Packages Wiki Activity

11.0: More work

Browse source
This commit is contained in:
Tad 2018-07-10 08:29:08 -04:00
parent 5716c58485
commit 966f4a5baf
6 changed files with 159 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

27
Patches/LineageOS-11.0/android_external_sqlite/0001-Secure_Delete.patch Normal file
View file

@ -0,0 +1,27 @@
From de55e0158ad3a6f89718c1d9fb19d336dea34937 Mon Sep 17 00:00:00 2001
From: Daniel Micay <danielmicay@gmail.com>
Date: Tue, 10 Jul 2018 08:09:29 -0400
Subject: [PATCH] Enable secure_delete by default
Change-Id: Iad6cea9f6489759faee04926213163a56dab1b9b
---
dist/Android.mk | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/dist/Android.mk b/dist/Android.mk
index 96e3035..4692f3f 100644
--- a/dist/Android.mk
+++ b/dist/Android.mk
@@ -28,7 +28,8 @@ common_sqlite_flags := \
-DSQLITE_OMIT_COMPILEOPTION_DIAGS \
-DSQLITE_OMIT_LOAD_EXTENSION \
-DSQLITE_DEFAULT_FILE_PERMISSIONS=0600 \
- -Dfdatasync=fdatasync
+ -Dfdatasync=fdatasync \
+ -DSQLITE_SECURE_DELETE
common_src_files := sqlite3.c
--
2.18.0

66
Patches/LineageOS-11.0/android_frameworks_base/0001-Signature_Spoofing.patch Normal file
View file

@ -0,0 +1,66 @@
diff --git a/core/java/android/content/pm/PackageParser.java b/core/java/android/content/pm/PackageParser.java
index e6da288..66684d3 100644
--- a/core/java/android/content/pm/PackageParser.java
+++ b/core/java/android/content/pm/PackageParser.java
@@ -447,10 +447,23 @@ public class PackageParser {
}
}
if ((flags&PackageManager.GET_SIGNATURES) != 0) {
- int N = (p.mSignatures != null) ? p.mSignatures.length : 0;
- if (N > 0) {
- pi.signatures = new Signature[N];
- System.arraycopy(p.mSignatures, 0, pi.signatures, 0, N);
+ boolean handledFakeSignature = false;
+ try {
+ if (p.requestedPermissions.contains("android.permission.FAKE_PACKAGE_SIGNATURE") && p.mAppMetaData != null
+ && p.mAppMetaData.get("fake-signature") instanceof String) {
+ pi.signatures = new Signature[] {new Signature(p.mAppMetaData.getString("fake-signature"))};
+ handledFakeSignature = true;
+ }
+ } catch (Throwable t) {
+ // We should never die because of any failures, this is system code!
+ Log.w("PackageParser.FAKE_PACKAGE_SIGNATURE", t);
+ }
+ if (!handledFakeSignature) {
+ int N = (p.mSignatures != null) ? p.mSignatures.length : 0;
+ if (N > 0) {
+ pi.signatures = new Signature[N];
+ System.arraycopy(p.mSignatures, 0, pi.signatures, 0, N);
+ }
}
}
return pi;
diff --git a/core/res/AndroidManifest.xml b/core/res/AndroidManifest.xml
index 558a475..4e7aa65 100644
--- a/core/res/AndroidManifest.xml
+++ b/core/res/AndroidManifest.xml
@@ -1562,6 +1562,13 @@
android:label="@string/permlab_getPackageSize"
android:description="@string/permdesc_getPackageSize" />
+ <!-- Allows an application to change the package signature as seen by applications -->
+ <permission android:name="android.permission.FAKE_PACKAGE_SIGNATURE"
+ android:permissionGroup="android.permission-group.SYSTEM_TOOLS"
+ android:protectionLevel="dangerous"
+ android:label="@string/permlab_fakePackageSignature"
+ android:description="@string/permdesc_fakePackageSignature" />
+
<!-- @deprecated No longer useful, see
{@link android.content.pm.PackageManager#addPackageToPreferred}
for details. -->
diff --git a/core/res/res/values/strings.xml b/core/res/res/values/strings.xml
index 790e166..8e66470 100644
--- a/core/res/res/values/strings.xml
+++ b/core/res/res/values/strings.xml
@@ -1135,6 +1135,11 @@
<string name="permdesc_getPackageSize">Allows the app to retrieve its code, data, and cache sizes</string>
<!-- Title of an application permission, listed so the user can choose whether they want to allow the application to do this. -->
+ <string name="permlab_fakePackageSignature">mimic package signature</string>
+ <!-- Description of an application permission, listed so the user can choose whether they want to allow the application to do this. -->
+ <string name="permdesc_fakePackageSignature">Allows the app to use mimic another app\'s package signature.</string>
+
+ <!-- Title of an application permission, listed so the user can choose whether they want to allow the application to do this. -->
<string name="permlab_installPackages">directly install apps</string>
<!-- Description of an application permission, listed so the user can choose whether they want to allow the application to do this. -->
<string name="permdesc_installPackages">Allows the app to install new or updated

26
Patches/LineageOS-11.0/android_frameworks_base/0002-Harden_Sig_Spoofing.patch Normal file
View file

@ -0,0 +1,26 @@
From 79c65fa6741cecda0b38a4881a07ec54a4896b69 Mon Sep 17 00:00:00 2001
From: Tad <tad@spotco.us>
Date: Tue, 10 Jul 2018 08:13:23 -0400
Subject: [PATCH] Harden signature spoofing
Change-Id: Iad362df358cb9cdf6e2ce9d511f09ee6b77a90e2
---
core/res/AndroidManifest.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/core/res/AndroidManifest.xml b/core/res/AndroidManifest.xml
index 1e5a7ad1f9..224fea23c8 100644
--- a/core/res/AndroidManifest.xml
+++ b/core/res/AndroidManifest.xml
@@ -1598,7 +1598,7 @@
<!-- Allows an application to change the package signature as seen by applications -->
<permission android:name="android.permission.FAKE_PACKAGE_SIGNATURE"
android:permissionGroup="android.permission-group.SYSTEM_TOOLS"
- android:protectionLevel="dangerous"
+ android:protectionLevel="signature"
android:label="@string/permlab_fakePackageSignature"
android:description="@string/permdesc_fakePackageSignature" />
--
2.18.0

30
Patches/LineageOS-11.0/android_system_core/0001-Harden_Mounts.patch Normal file
View file

@ -0,0 +1,30 @@
From f19ab3bce2115c6ddf24528885305c3ba038f29b Mon Sep 17 00:00:00 2001
From: Daniel Micay <danielmicay@gmail.com>
Date: Tue, 10 Jul 2018 08:22:08 -0400
Subject: [PATCH] Harden mounts
Change-Id: I2db94882224672cac3e54f7d8422d1e036828378
---
init/init.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/init/init.c b/init/init.c
index 53e0dae1..d022253b 100644
--- a/init/init.c
+++ b/init/init.c
@@ -1136,9 +1136,9 @@ int main(int argc, char **argv)
mount("tmpfs", "/dev", "tmpfs", MS_NOSUID, "mode=0755");
mkdir("/dev/pts", 0755);
mkdir("/dev/socket", 0755);
- mount("devpts", "/dev/pts", "devpts", 0, NULL);
- mount("proc", "/proc", "proc", 0, NULL);
- mount("sysfs", "/sys", "sysfs", 0, NULL);
+ mount("devpts", "/dev/pts", "devpts", MS_NOSUID|MS_NOEXEC, NULL);
+ mount("proc", "/proc", "proc", MS_NOSUID|MS_NODEV|MS_NOEXEC, NULL);
+ mount("sysfs", "/sys", "sysfs", MS_NOSUID|MS_NODEV|MS_NOEXEC, NULL);
/* indicate that booting is in progress to background fw loaders, etc */
close(open("/dev/.booting", O_WRONLY | O_CREAT, 0000));
--
2.18.0