From f5af24bbcb0c577524a8de8eaf0a8c1f7f64361e Mon Sep 17 00:00:00 2001 From: Tad Date: Mon, 29 May 2017 20:19:40 -0400 Subject: [PATCH] Fix patch authors --- .../0001-Secure_Delete.patch | 2 +- .../0003-Signature_Spoofing.patch | 2 +- .../android_system_core/0001-Hardening.patch | 22 +++++++++---------- Scripts/LAOS-14.1_Patches.sh | 8 +++---- 4 files changed, 17 insertions(+), 17 deletions(-) diff --git a/Patches/LineageOS-14.1/android_external_sqlite/0001-Secure_Delete.patch b/Patches/LineageOS-14.1/android_external_sqlite/0001-Secure_Delete.patch index b2edcd6c..91411dd6 100644 --- a/Patches/LineageOS-14.1/android_external_sqlite/0001-Secure_Delete.patch +++ b/Patches/LineageOS-14.1/android_external_sqlite/0001-Secure_Delete.patch @@ -1,5 +1,5 @@ From d06526ec844bf89e77c518dbcd0deb331babf8dd Mon Sep 17 00:00:00 2001 -From: Tad +From: Daniel Micay Date: Sun, 18 Dec 2016 09:30:44 -0500 Subject: [PATCH] Enable secure_delete by default diff --git a/Patches/LineageOS-14.1/android_frameworks_base/0003-Signature_Spoofing.patch b/Patches/LineageOS-14.1/android_frameworks_base/0003-Signature_Spoofing.patch index 361e17bf..2dc7bbd5 100644 --- a/Patches/LineageOS-14.1/android_frameworks_base/0003-Signature_Spoofing.patch +++ b/Patches/LineageOS-14.1/android_frameworks_base/0003-Signature_Spoofing.patch @@ -1,5 +1,5 @@ From 44cda6f5e47c33e91980ae35c8bc6d88e4d3763c Mon Sep 17 00:00:00 2001 -From: Tad +From: be-neth Date: Thu, 24 Nov 2016 13:01:30 -0500 Subject: [PATCH] Allow packages to spoof their signature diff --git a/Patches/LineageOS-14.1/android_system_core/0001-Hardening.patch b/Patches/LineageOS-14.1/android_system_core/0001-Hardening.patch index 172cbb3d..9ed8ca69 100644 --- a/Patches/LineageOS-14.1/android_system_core/0001-Hardening.patch +++ b/Patches/LineageOS-14.1/android_system_core/0001-Hardening.patch @@ -1,19 +1,19 @@ -From b3c84ac50cce7f7f9a045a1b8a43adc77408bf6e Mon Sep 17 00:00:00 2001 -From: Tad -Date: Sun, 18 Dec 2016 09:51:27 -0500 -Subject: [PATCH] Misc hardening +From f744a5628bbc7c97065b9355282c97d4c4cb1d60 Mon Sep 17 00:00:00 2001 +From: Daniel Micay +Date: Mon, 29 May 2017 20:13:03 -0400 +Subject: [PATCH] Harden mounts and network -Change-Id: I19525796263febdcf616fcf82eb5bb714a236a0d +Change-Id: I56e8371048f83f429009c3024f8aff99c9952d9c --- init/init.cpp | 6 +++--- rootdir/init.rc | 16 ++++++++++++++++ 2 files changed, 19 insertions(+), 3 deletions(-) diff --git a/init/init.cpp b/init/init.cpp -index 9992b47..fa82d3b 100755 +index 7a370596e..35bf44a7b 100755 --- a/init/init.cpp +++ b/init/init.cpp -@@ -573,10 +573,10 @@ int main(int argc, char** argv) { +@@ -579,10 +579,10 @@ int main(int argc, char** argv) { mount("tmpfs", "/dev", "tmpfs", MS_NOSUID, "mode=0755"); mkdir("/dev/pts", 0755); mkdir("/dev/socket", 0755); @@ -28,10 +28,10 @@ index 9992b47..fa82d3b 100755 // We must have some place other than / to create the device nodes for diff --git a/rootdir/init.rc b/rootdir/init.rc -index cd97776..38e68d1 100644 +index 671c6b71f..a5da76318 100644 --- a/rootdir/init.rc +++ b/rootdir/init.rc -@@ -122,6 +122,7 @@ on init +@@ -126,6 +126,7 @@ on init write /proc/sys/kernel/sched_child_runs_first 0 write /proc/sys/kernel/randomize_va_space 2 @@ -39,7 +39,7 @@ index cd97776..38e68d1 100644 write /proc/sys/kernel/kptr_restrict 2 write /proc/sys/vm/mmap_min_addr 32768 write /proc/sys/net/ipv4/ping_group_range "0 2147483647" -@@ -140,6 +141,21 @@ on init +@@ -144,6 +145,21 @@ on init write /proc/sys/net/ipv4/conf/all/accept_redirects 0 write /proc/sys/net/ipv6/conf/all/accept_redirects 0 @@ -62,5 +62,5 @@ index cd97776..38e68d1 100644 mkdir /dev/cpuctl mount cgroup none /dev/cpuctl cpu -- -2.9.3 +2.13.0 diff --git a/Scripts/LAOS-14.1_Patches.sh b/Scripts/LAOS-14.1_Patches.sh index 93c59b83..ff36f125 100755 --- a/Scripts/LAOS-14.1_Patches.sh +++ b/Scripts/LAOS-14.1_Patches.sh @@ -68,7 +68,7 @@ enter "external/noto-fonts" cp /tmp/ar/emojione-android.ttf other/NotoColorEmoji.ttf #Change emoji font to EmojiOne enter "external/sqlite" -patch -p1 < $patches"android_external_sqlite/0001-Secure_Delete.patch" #Enable secure_delete by default TODO: Fix patch author +patch -p1 < $patches"android_external_sqlite/0001-Secure_Delete.patch" #Enable secure_delete by default enter "external/svox" git fetch https://android.googlesource.com/platform/external/svox refs/changes/72/302872/2 && git cherry-pick FETCH_HEAD #Fix garbled output See https://android-review.googlesource.com/#/c/302872/ @@ -77,7 +77,7 @@ enter "frameworks/base" git revert 0326bb5e41219cf502727c3aa44ebf2daa19a5b3 #re-enable doze on devices without gms git fetch https://review.lineageos.org/LineageOS/android_frameworks_base refs/changes/75/151975/31 && git cherry-pick FETCH_HEAD #network traffic sed -i 's/DEFAULT_MAX_FILES = 1000;/DEFAULT_MAX_FILES = 0;/' services/core/java/com/android/server/DropBoxManagerService.java; #Disable DropBox -patch -p1 < $patches"android_frameworks_base/0003-Signature_Spoofing.patch" #Allow packages to spoof their signature (MicroG) TODO: Fix patch author +patch -p1 < $patches"android_frameworks_base/0003-Signature_Spoofing.patch" #Allow packages to spoof their signature (MicroG) patch -p1 < $patches"android_frameworks_base/0005-Harden_Sig_Spoofing.patch" #Restrict signature spoofing to system apps signed with the platform key rm core/res/res/values/config.xml.orig core/res/res/values/strings.xml.orig core/res/AndroidManifest.xml.orig @@ -123,7 +123,7 @@ sed -i 's/GSETTINGS_PROVIDER = "com.google.settings";/GSETTINGS_PROVIDER = "com. enter "system/core" cat /tmp/ar/hosts >> rootdir/etc/hosts #Merge in our HOSTS file -patch -p1 < $patches"android_system_core/0001-Hardening.patch" #Misc hardening TODO: Fix patch author +patch -p1 < $patches"android_system_core/0001-Hardening.patch" #Misc hardening #enter "system/netd" #patch -p1 < $patches"android_systemd_netd/0001-iptables.patch"; #Network hardening via iptables XXX: Untested @@ -131,7 +131,7 @@ patch -p1 < $patches"android_system_core/0001-Hardening.patch" #Misc hardening T enter "vendor/cm" patch -p1 < $patches"android_vendor_cm/0001-SCE.patch" #Include our extras such as MicroG and F-Droid cp $patches"android_vendor_cm/sce.mk" config/sce.mk -sed -i 's/CM_BUILDTYPE := UNOFFICIAL/CM_BUILDTYPE := dsc/' config/common.mk; +sed -i 's/CM_BUILDTYPE := UNOFFICIAL/CM_BUILDTYPE := dsc/' config/common.mk; #Change buildtype enter "vendor/cmsdk" git fetch https://review.lineageos.org/LineageOS/cm_platform_sdk refs/changes/21/148321/12 && git cherry-pick FETCH_HEAD #network traffic