Signed-off-by: Tad <tad@spotco.us>
This commit is contained in:
Tad 2023-08-12 16:22:42 -04:00
parent 160aee5049
commit 9707326c4f
No known key found for this signature in database
GPG key ID: B286E9F57A07424B
37 changed files with 52 additions and 63 deletions

View file

@ -124,7 +124,6 @@ patchWorkspaceReal() {
repopick -fit msm8974-gps-r;
repopick -fit hh-vsync;
repopick -fi 311299;
repopick -it R_asb_2023-08;
sh "$DOS_SCRIPTS/Patch.sh";
sh "$DOS_SCRIPTS_COMMON/Enable_Verity.sh";

View file

@ -96,7 +96,6 @@ sed -i '75i$(my_res_package): PRIVATE_AAPT_FLAGS += --auto-add-overlay' core/aap
awk -i inplace '!/updatable_apex.mk/' target/product/mainline_system.mk; #Disable APEX
sed -i 's/PLATFORM_MIN_SUPPORTED_TARGET_SDK_VERSION := 23/PLATFORM_MIN_SUPPORTED_TARGET_SDK_VERSION := 28/' core/version_defaults.mk; #Set the minimum supported target SDK to Pie (GrapheneOS)
#sed -i 's/PRODUCT_OTA_ENFORCE_VINTF_KERNEL_REQUIREMENTS := true/PRODUCT_OTA_ENFORCE_VINTF_KERNEL_REQUIREMENTS := false/' core/product_config.mk; #broken by hardenDefconfig
sed -i 's/2023-07-05/2023-08-05/' core/version_defaults.mk; #Bump Security String #R_asb_2023-08 #XXX
fi;
if enterAndClear "build/soong"; then
@ -312,10 +311,6 @@ applyPatch "$DOS_PATCHES/android_packages_apps_PermissionController/0002-Special
applyPatch "$DOS_PATCHES/android_packages_apps_PermissionController/0002-Special_Permissions-3.patch"; #UI fix for special runtime permission (GrapheneOS)
fi;
if enterAndClear "packages/apps/QuickAccessWallet"; then
git fetch https://github.com/LineageOS/android_packages_apps_QuickAccessWallet refs/changes/39/364039/1 && git cherry-pick FETCH_HEAD; #R_asb_2023-08
fi;
if enterAndClear "packages/apps/Settings"; then
#applyPatch "$DOS_PATCHES/android_packages_apps_Settings/0001-Captive_Portal_Toggle.patch"; #Add option to disable captive portal checks (MSe1969)
applyPatch "$DOS_PATCHES/android_packages_apps_Settings/0001-Captive_Portal_Toggle-gos.patch"; #Add option to disable captive portal checks (GrapheneOS)

View file

@ -86,10 +86,9 @@ patchWorkspaceReal() {
verifyAllPlatformTags;
gpgVerifyGitHead "$DOS_BUILD_BASE/external/chromium-webview";
source build/envsetup.sh;
#source build/envsetup.sh;
#repopick -ift twelve-bt-sbc-hd-dualchannel;
#repopick -it twelve-colors;
repopick -it S_asb_2023-08;
sh "$DOS_SCRIPTS/Patch.sh";
sh "$DOS_SCRIPTS_COMMON/Enable_Verity.sh";

View file

@ -98,7 +98,6 @@ sed -i '75i$(my_res_package): PRIVATE_AAPT_FLAGS += --auto-add-overlay' core/aap
awk -i inplace '!/updatable_apex.mk/' target/product/generic_system.mk; #Disable APEX
sed -i 's/PLATFORM_MIN_SUPPORTED_TARGET_SDK_VERSION := 23/PLATFORM_MIN_SUPPORTED_TARGET_SDK_VERSION := 28/' core/version_defaults.mk; #Set the minimum supported target SDK to Pie (GrapheneOS)
#sed -i 's/PRODUCT_OTA_ENFORCE_VINTF_KERNEL_REQUIREMENTS := true/PRODUCT_OTA_ENFORCE_VINTF_KERNEL_REQUIREMENTS := false/' core/product_config.mk; #broken by hardenDefconfig
sed -i 's/2023-07-05/2023-08-05/' core/version_defaults.mk; #Bump Security String #S_asb_2023-08 #XXX
fi;
if enterAndClear "build/soong"; then
@ -106,10 +105,6 @@ applyPatch "$DOS_PATCHES/android_build_soong/0001-Enable_fwrapv.patch"; #Use -fw
if [ "$DOS_GRAPHENE_MALLOC" = true ]; then applyPatch "$DOS_PATCHES/android_build_soong/0002-hm_apex.patch"; fi; #(GrapheneOS)
fi;
if enterAndClear "external/aac"; then
git fetch https://github.com/LineageOS/android_external_aac refs/changes/80/363980/1 && git cherry-pick FETCH_HEAD; #S_asb_2023-08
fi;
if enterAndClear "external/chromium-webview"; then
if [ "$(type -t DOS_WEBVIEW_CHERRYPICK)" = "alias" ] ; then DOS_WEBVIEW_CHERRYPICK; fi; #Update the WebView to latest if available
if [ "$DOS_WEBVIEW_LFS" = true ]; then git lfs pull; fi; #Ensure the objects are available
@ -293,10 +288,6 @@ applyPatch "$DOS_PATCHES/android_packages_apps_LineageParts/0001-Remove_Analytic
cp -f "$DOS_PATCHES_COMMON/contributors.db" assets/contributors.db; #Update contributors cloud
fi;
if enterAndClear "packages/apps/ManagedProvisioning"; then
git fetch https://github.com/LineageOS/android_packages_apps_ManagedProvisioning refs/changes/19/364019/1 && git cherry-pick FETCH_HEAD; #S_asb_2023-08
fi;
if enterAndClear "packages/apps/Nfc"; then
if [ "$DOS_GRAPHENE_CONSTIFY" = true ]; then applyPatch "$DOS_PATCHES/android_packages_apps_Nfc/0001-constify_JNINativeMethod.patch"; fi; #Constify JNINativeMethod tables (GrapheneOS)
fi;

View file

@ -223,7 +223,7 @@ git apply $DOS_PATCHES_LINUX_CVES/CVE-2023-35824/4.4/0001.patch
git apply $DOS_PATCHES_LINUX_CVES/0008-Graphene-Kernel_Hardening-ro/4.9/0016.patch
git apply $DOS_PATCHES_LINUX_CVES/0008-Graphene-Kernel_Hardening-ro/4.9/0029.patch
git apply $DOS_PATCHES_LINUX_CVES/0008-Graphene-Kernel_Hardening-slab/4.4/0004.patch
editKernelLocalversion "-dos.p224"
editKernelLocalversion "-dos.p223"
else echo "kernel_essential_msm8998 is unavailable, not patching.";
fi;
cd "$DOS_BUILD_BASE"

View file

@ -113,7 +113,7 @@ git apply $DOS_PATCHES_LINUX_CVES/0008-Graphene-Kernel_Hardening-fortify/4.9/000
git apply $DOS_PATCHES_LINUX_CVES/0008-Graphene-Kernel_Hardening-ro/4.9/0016.patch
git apply $DOS_PATCHES_LINUX_CVES/0008-Graphene-Kernel_Hardening-ro/4.9/0029.patch
git apply $DOS_PATCHES_LINUX_CVES/0008-Graphene-Kernel_Hardening-slab/4.9/0005.patch
editKernelLocalversion "-dos.p114"
editKernelLocalversion "-dos.p113"
else echo "kernel_fairphone_sdm632 is unavailable, not patching.";
fi;
cd "$DOS_BUILD_BASE"

View file

@ -83,7 +83,7 @@ git apply $DOS_PATCHES_LINUX_CVES/CVE-2023-4133/^6.3/0001.patch
git apply $DOS_PATCHES_LINUX_CVES/CVE-2023-4134/^6.3/0001.patch
git apply $DOS_PATCHES_LINUX_CVES/CVE-2023-23000/^5.16/0001.patch
git apply $DOS_PATCHES_LINUX_CVES/CVE-2023-35001/^6.4/0001.patch
editKernelLocalversion "-dos.p84"
editKernelLocalversion "-dos.p83"
else echo "kernel_fairphone_sm7225 is unavailable, not patching.";
fi;
cd "$DOS_BUILD_BASE"

View file

@ -170,7 +170,7 @@ git apply $DOS_PATCHES_LINUX_CVES/CVE-2023-30772/4.4/0008.patch
git apply $DOS_PATCHES_LINUX_CVES/CVE-2023-32269/4.4/0001.patch
git apply $DOS_PATCHES_LINUX_CVES/CVE-2023-34256/4.4/0008.patch
git apply $DOS_PATCHES_LINUX_CVES/CVE-2023-35824/4.4/0001.patch
editKernelLocalversion "-dos.p171"
editKernelLocalversion "-dos.p170"
else echo "kernel_fxtec_msm8998 is unavailable, not patching.";
fi;
cd "$DOS_BUILD_BASE"

View file

@ -83,7 +83,7 @@ git apply $DOS_PATCHES_LINUX_CVES/CVE-2023-4133/^6.3/0001.patch
git apply $DOS_PATCHES_LINUX_CVES/CVE-2023-4134/^6.3/0001.patch
git apply $DOS_PATCHES_LINUX_CVES/CVE-2023-23000/^5.16/0001.patch
git apply $DOS_PATCHES_LINUX_CVES/CVE-2023-35001/^6.4/0001.patch
editKernelLocalversion "-dos.p84"
editKernelLocalversion "-dos.p83"
else echo "kernel_fxtec_sm6115 is unavailable, not patching.";
fi;
cd "$DOS_BUILD_BASE"

View file

@ -122,7 +122,7 @@ git apply $DOS_PATCHES_LINUX_CVES/CVE-2023-32269/4.14/0003.patch
git apply $DOS_PATCHES_LINUX_CVES/CVE-2023-34256/4.14/0002.patch
git apply $DOS_PATCHES_LINUX_CVES/CVE-2023-35001/^6.4/0001.patch
git apply $DOS_PATCHES_LINUX_CVES/CVE-2023-35824/4.14/0003.patch
editKernelLocalversion "-dos.p123"
editKernelLocalversion "-dos.p122"
else echo "kernel_google_msm-4.14 is unavailable, not patching.";
fi;
cd "$DOS_BUILD_BASE"

View file

@ -119,7 +119,7 @@ git apply $DOS_PATCHES_LINUX_CVES/0008-Graphene-Kernel_Hardening-fortify/4.9/000
git apply $DOS_PATCHES_LINUX_CVES/0008-Graphene-Kernel_Hardening-ro/4.9/0016.patch
git apply $DOS_PATCHES_LINUX_CVES/0008-Graphene-Kernel_Hardening-ro/4.9/0029.patch
git apply $DOS_PATCHES_LINUX_CVES/0008-Graphene-Kernel_Hardening-slab/4.9/0005.patch
editKernelLocalversion "-dos.p120"
editKernelLocalversion "-dos.p119"
else echo "kernel_google_msm-4.9 is unavailable, not patching.";
fi;
cd "$DOS_BUILD_BASE"

View file

@ -142,7 +142,7 @@ git apply $DOS_PATCHES_LINUX_CVES/CVE-2023-35788/4.19/0002.patch
git apply $DOS_PATCHES_LINUX_CVES/CVE-2023-35823/4.19/0002.patch
git apply $DOS_PATCHES_LINUX_CVES/CVE-2023-35824/4.19/0004.patch
git apply $DOS_PATCHES_LINUX_CVES/CVE-2023-35828/4.19/0002.patch
editKernelLocalversion "-dos.p143"
editKernelLocalversion "-dos.p142"
else echo "kernel_google_redbull is unavailable, not patching.";
fi;
cd "$DOS_BUILD_BASE"

View file

@ -187,7 +187,7 @@ git apply $DOS_PATCHES_LINUX_CVES/CVE-2023-35824/4.4/0001.patch
git apply $DOS_PATCHES_LINUX_CVES/0008-Graphene-Kernel_Hardening-ro/4.9/0016.patch
git apply $DOS_PATCHES_LINUX_CVES/0008-Graphene-Kernel_Hardening-ro/4.9/0029.patch
git apply $DOS_PATCHES_LINUX_CVES/0008-Graphene-Kernel_Hardening-slab/4.4/0004.patch
editKernelLocalversion "-dos.p188"
editKernelLocalversion "-dos.p187"
else echo "kernel_google_wahoo is unavailable, not patching.";
fi;
cd "$DOS_BUILD_BASE"

View file

@ -170,7 +170,7 @@ git apply $DOS_PATCHES_LINUX_CVES/CVE-2023-30772/4.4/0008.patch
git apply $DOS_PATCHES_LINUX_CVES/CVE-2023-32269/4.4/0001.patch
git apply $DOS_PATCHES_LINUX_CVES/CVE-2023-34256/4.4/0008.patch
git apply $DOS_PATCHES_LINUX_CVES/CVE-2023-35824/4.4/0001.patch
editKernelLocalversion "-dos.p171"
editKernelLocalversion "-dos.p170"
else echo "kernel_oneplus_msm8998 is unavailable, not patching.";
fi;
cd "$DOS_BUILD_BASE"

View file

@ -113,7 +113,7 @@ git apply $DOS_PATCHES_LINUX_CVES/0008-Graphene-Kernel_Hardening-fortify/4.9/000
git apply $DOS_PATCHES_LINUX_CVES/0008-Graphene-Kernel_Hardening-ro/4.9/0016.patch
git apply $DOS_PATCHES_LINUX_CVES/0008-Graphene-Kernel_Hardening-ro/4.9/0029.patch
git apply $DOS_PATCHES_LINUX_CVES/0008-Graphene-Kernel_Hardening-slab/4.9/0005.patch
editKernelLocalversion "-dos.p114"
editKernelLocalversion "-dos.p113"
else echo "kernel_oneplus_sdm845 is unavailable, not patching.";
fi;
cd "$DOS_BUILD_BASE"

View file

@ -116,7 +116,7 @@ git apply $DOS_PATCHES_LINUX_CVES/CVE-2023-35788/4.19/0002.patch
git apply $DOS_PATCHES_LINUX_CVES/CVE-2023-35823/4.19/0002.patch
git apply $DOS_PATCHES_LINUX_CVES/CVE-2023-35824/4.19/0004.patch
git apply $DOS_PATCHES_LINUX_CVES/CVE-2023-35828/4.19/0002.patch
editKernelLocalversion "-dos.p117"
editKernelLocalversion "-dos.p116"
else echo "kernel_oneplus_sm7250 is unavailable, not patching.";
fi;
cd "$DOS_BUILD_BASE"

View file

@ -474,7 +474,7 @@ git apply $DOS_PATCHES_LINUX_CVES/CVE-2023-35824/4.14/0003.patch
git apply $DOS_PATCHES_LINUX_CVES/CVE-2020-0466/4.14/0005.patch
git apply $DOS_PATCHES_LINUX_CVES/CVE-2020-24586/4.14/0003.patch
git apply $DOS_PATCHES_LINUX_CVES/CVE-2020-27830/4.14/0002.patch
editKernelLocalversion "-dos.p475"
editKernelLocalversion "-dos.p474"
else echo "kernel_oneplus_sm8150 is unavailable, not patching.";
fi;
cd "$DOS_BUILD_BASE"

View file

@ -81,7 +81,7 @@ git apply $DOS_PATCHES_LINUX_CVES/CVE-2023-4133/^6.3/0001.patch
git apply $DOS_PATCHES_LINUX_CVES/CVE-2023-4134/^6.3/0001.patch
git apply $DOS_PATCHES_LINUX_CVES/CVE-2023-23000/^5.16/0001.patch
git apply $DOS_PATCHES_LINUX_CVES/CVE-2023-35001/^6.4/0001.patch
editKernelLocalversion "-dos.p82"
editKernelLocalversion "-dos.p81"
else echo "kernel_oneplus_sm8250 is unavailable, not patching.";
fi;
cd "$DOS_BUILD_BASE"

View file

@ -50,7 +50,7 @@ git apply $DOS_PATCHES_LINUX_CVES/CVE-2023-35823/5.4/0005.patch
git apply $DOS_PATCHES_LINUX_CVES/CVE-2023-35824/5.4/0007.patch
git apply $DOS_PATCHES_LINUX_CVES/CVE-2023-35826/^6.3/0001.patch
git apply $DOS_PATCHES_LINUX_CVES/CVE-2023-35828/5.4/0005.patch
editKernelLocalversion "-dos.p51"
editKernelLocalversion "-dos.p50"
else echo "kernel_oneplus_sm8350 is unavailable, not patching.";
fi;
cd "$DOS_BUILD_BASE"

View file

@ -170,7 +170,7 @@ git apply $DOS_PATCHES_LINUX_CVES/CVE-2023-30772/4.4/0008.patch
git apply $DOS_PATCHES_LINUX_CVES/CVE-2023-32269/4.4/0001.patch
git apply $DOS_PATCHES_LINUX_CVES/CVE-2023-34256/4.4/0008.patch
git apply $DOS_PATCHES_LINUX_CVES/CVE-2023-35824/4.4/0001.patch
editKernelLocalversion "-dos.p171"
editKernelLocalversion "-dos.p170"
else echo "kernel_razer_msm8998 is unavailable, not patching.";
fi;
cd "$DOS_BUILD_BASE"

View file

@ -113,7 +113,7 @@ git apply $DOS_PATCHES_LINUX_CVES/0008-Graphene-Kernel_Hardening-fortify/4.9/000
git apply $DOS_PATCHES_LINUX_CVES/0008-Graphene-Kernel_Hardening-ro/4.9/0016.patch
git apply $DOS_PATCHES_LINUX_CVES/0008-Graphene-Kernel_Hardening-ro/4.9/0029.patch
git apply $DOS_PATCHES_LINUX_CVES/0008-Graphene-Kernel_Hardening-slab/4.9/0005.patch
editKernelLocalversion "-dos.p114"
editKernelLocalversion "-dos.p113"
else echo "kernel_razer_sdm845 is unavailable, not patching.";
fi;
cd "$DOS_BUILD_BASE"

View file

@ -596,7 +596,7 @@ git apply $DOS_PATCHES_LINUX_CVES/0008-Graphene-Kernel_Hardening-ro/4.9/0016.pat
git apply $DOS_PATCHES_LINUX_CVES/0008-Graphene-Kernel_Hardening-ro/4.9/0029.patch
git apply $DOS_PATCHES_LINUX_CVES/CVE-2019-14283/4.9/0008.patch
git apply $DOS_PATCHES_LINUX_CVES/CVE-2021-37159/4.9/0007.patch
editKernelLocalversion "-dos.p597"
editKernelLocalversion "-dos.p596"
else echo "kernel_samsung_exynos9810 is unavailable, not patching.";
fi;
cd "$DOS_BUILD_BASE"

View file

@ -435,7 +435,7 @@ git apply $DOS_PATCHES_LINUX_CVES/0008-Graphene-Kernel_Hardening-ro/4.9/0029.pat
git apply $DOS_PATCHES_LINUX_CVES/0008-Graphene-Kernel_Hardening-slab/4.9/0005.patch
git apply $DOS_PATCHES_LINUX_CVES/CVE-2020-24586/4.9/0009.patch
git apply $DOS_PATCHES_LINUX_CVES/CVE-2021-37159/4.9/0007.patch
editKernelLocalversion "-dos.p436"
editKernelLocalversion "-dos.p435"
else echo "kernel_sony_sdm845 is unavailable, not patching.";
fi;
cd "$DOS_BUILD_BASE"

View file

@ -112,7 +112,7 @@ git apply $DOS_PATCHES_LINUX_CVES/0008-Graphene-Kernel_Hardening-fortify/4.9/000
git apply $DOS_PATCHES_LINUX_CVES/0008-Graphene-Kernel_Hardening-ro/4.9/0016.patch
git apply $DOS_PATCHES_LINUX_CVES/0008-Graphene-Kernel_Hardening-ro/4.9/0029.patch
git apply $DOS_PATCHES_LINUX_CVES/0008-Graphene-Kernel_Hardening-slab/4.9/0005.patch
editKernelLocalversion "-dos.p113"
editKernelLocalversion "-dos.p112"
else echo "kernel_xiaomi_msm8937 is unavailable, not patching.";
fi;
cd "$DOS_BUILD_BASE"

View file

@ -115,7 +115,7 @@ git apply $DOS_PATCHES_LINUX_CVES/0008-Graphene-Kernel_Hardening-fortify/4.9/000
git apply $DOS_PATCHES_LINUX_CVES/0008-Graphene-Kernel_Hardening-ro/4.9/0016.patch
git apply $DOS_PATCHES_LINUX_CVES/0008-Graphene-Kernel_Hardening-ro/4.9/0029.patch
git apply $DOS_PATCHES_LINUX_CVES/0008-Graphene-Kernel_Hardening-slab/4.9/0005.patch
editKernelLocalversion "-dos.p116"
editKernelLocalversion "-dos.p115"
else echo "kernel_xiaomi_sdm845 is unavailable, not patching.";
fi;
cd "$DOS_BUILD_BASE"

View file

@ -95,7 +95,7 @@ git apply $DOS_PATCHES_LINUX_CVES/CVE-2023-35788/4.19/0002.patch
git apply $DOS_PATCHES_LINUX_CVES/CVE-2023-35823/4.19/0002.patch
git apply $DOS_PATCHES_LINUX_CVES/CVE-2023-35824/4.19/0004.patch
git apply $DOS_PATCHES_LINUX_CVES/CVE-2023-35828/4.19/0002.patch
editKernelLocalversion "-dos.p96"
editKernelLocalversion "-dos.p95"
else echo "kernel_xiaomi_sm8250 is unavailable, not patching.";
fi;
cd "$DOS_BUILD_BASE"

View file

@ -444,6 +444,10 @@ if enterAndClear "device/essential/mata"; then
echo "allow permissioncontroller_app tethering_service:service_manager find;" > sepolicy/private/permissioncontroller_app.te;
fi;
if enterAndClear "device/fxtec/pro1"; then
echo "type qti_debugfs, fs_type, debugfs_type;" >> sepolicy/vendor/file.te; #fixup
fi;
if enterAndClear "device/google/gs101"; then
git revert --no-edit 371473c97a3769f9b0629b33ae7014e78e1e31bb; #potential breakage
if [ "$DOS_DEBLOBBER_REMOVE_CNE" = true ]; then sed -i '/google iwlan/,+8d' device.mk; fi; #fix stray
@ -475,6 +479,7 @@ if enterAndClear "device/oneplus/msm8998-common"; then
#awk -i inplace '!/TARGET_RELEASETOOLS_EXTENSIONS/' BoardConfigCommon.mk; #disable releasetools to fix delta ota generation
sed -i '/PRODUCT_SYSTEM_VERITY_PARTITION/iPRODUCT_VENDOR_VERITY_PARTITION := /dev/block/bootdevice/by-name/vendor' common.mk; #Support verity on /vendor too
awk -i inplace '!/vendor_sensors_dbg_prop/' sepolicy/vendor/hal_camera_default.te; #fixup
echo "type qti_debugfs, fs_type, debugfs_type;" >> sepolicy/vendor/file.te; #fixup
fi;
if enterAndClear "device/xiaomi/mithorium-common"; then