[CLOSED] EOL [ROM][Unofficial][8.1.0][microG][signed]hardened LineageOS 15.1 for Oneplus 3T

MSe1969 · Feb 5, 2019

QUBiCA said:
Hi,

Thank you for your work! I just have two questions: do you spread updates via normal OTA or do we have to go to this thread to check for updates? I will definitely root it too with Magisk, would I need to redo this after every update?

No OTA, you would have to check this thread (Updater app is even not part of the build).
Magisk has got an updater script to "survive" updates (I.e. re-install after flashing), so it does not make any difference whether you would regularly flash or - if it was available - do OTA. So after flashing new build (as long as you don't wipe anything), Magisk will still be there.

MSe1969 · Feb 9, 2019

New build with February 2019 ASB

Hi all,
a new build is available for download with the February '19 security patches.
~~https://www.androidfilehost.com/?fid=1395089523397888325~~

EDIT: Please use this link

ASB Security string 2019-02-05
Bromite System Webview updated to M72
Kernel: merged CAF tag LA.UM.6.5.r1-10600-8x96.0 plus sec. patches of the February 2019 Android Security Bulletin

Happy flashing,
regards M.

hauckk@sfreserves.org · Feb 9, 2019

I know it is not meant to be used with gapps but would this room work if I flashed gapps would it crash/ perform badly etc issues

MSe1969 · Feb 9, 2019

hauckk@sfreserves.org said:
I know it is not meant to be used with gapps but would this room work if I flashed gapps would it crash/ perform badly etc issues

I expect issues because of the stricter sepolicy. Further, Gapps will replace some system files and thus a big portion of the hardening will be lost. It could also be, that safety net may fail. Or it could be, that it seems to work, but sporadic weird things happen sometimes.

So you can try, if you want, and report here. I haven't tried myself yet. If it indeed works (or mostly), it could be also interesting for others. However, I can't and I won't provide any support for this setup.

hauckk@sfreserves.org · Feb 10, 2019

MSe1969 said:
I expect issues because of the stricter sepolicy. Further, Gapps will replace some system files and thus a big portion of the hardening will be lost. It could also be, that safety net may fail. Or it could be, that it seems to work, but sporadic weird things happen sometimes.

So you can try, if you want, and report here. I haven't tried myself yet. If it indeed works (or mostly), it could be also interesting for others. However, I can't and I won't provide any support for this setup.

Thanks I might give it a try later and I understand that you are not going to provide support:highfive:

hauckk@sfreserves.org · Feb 10, 2019

MSe1969 said:
I expect issues because of the stricter sepolicy. Further, Gapps will replace some system files and thus a big portion of the hardening will be lost. It could also be, that safety net may fail. Or it could be, that it seems to work, but sporadic weird things happen sometimes.

So you can try, if you want, and report here. I haven't tried myself yet. If it indeed works (or mostly), it could be also interesting for others. However, I can't and I won't provide any support for this setup.

So I gave it a try didn't work setup wizard froze at searching for updates
I used open gapps nano 8.1
1/19/2019
And magisk 18.1
Clean flashed

eightfiveseven · Feb 10, 2019

So just to make sure because I'm doing this for the first time. Just reboot to recovery and install new build? No need to wipe anything? Some guides tell to wipe dalvik cache and cache and some to just install the update.

MSe1969 · Feb 10, 2019

eightfiveseven said:
So just to make sure because I'm doing this for the first time. Just reboot to recovery and install new build? No need to wipe anything? Some guides tell to wipe dalvik cache and cache and some to just install the update.

If you have my build installed, and you would like now to update to get the February ASB: All you need to do is to flash the new ZIP file in TWRP and choose "Install" - no need to wipe cache/dalvik.
The system will recognize by itself, which apps need the cache to be renewed. But if you wipe cache/dalvik, e.g. because TWRP usually offers this step directly after flashing, it won't harm anything. The next boot will take longer then. (As said, not necessary)

MSe1969 · Feb 10, 2019

hauckk@sfreserves.org said:
So I gave it a try didn't work setup wizard froze at searching for updates
I used open gapps nano 8.1
1/19/2019
And magisk 8.1
Clean flashed

Thanks for testing this. Surprised that already the Google Setup Wizard, which is called by the LineageOS SUW, goes on strike...

mumapizza · Feb 10, 2019

Hi, could you please merge linux stable into this kernel. We have an up to date linage15.1 tree from @nathanchance here: https://github.com/android-linux-stable/op3/commits/lineage-15.1

MSe1969 · Feb 10, 2019

mumapizza said:
Hi, could you please merge linux stable into this kernel. We have an up to date linage15.1 tree from @nathanchance here: https://github.com/android-linux-stable/op3/commits/lineage-15.1

I have started a while back to upstream the kernel to a local test branch, but this is less trivial than it may sound... Tbh, has not the highest priority: the sec. patches are in and the overall behavior is ok.

Stupidshark12 · Feb 11, 2019

Hi, loving the ROM so far.

A question: is it possible to get SafetyNet passing with at least basic integrity (if not CTS) with the microg included, or is this a lost cause?
I've heard SN has been spotty with microg in general lately, wondering if anyone has had luck on this ROM.
I'm using Magisk and the DroidGuard Helper from f-droid, but I'm willing to drop everything if I can get this working. I can't live without Snapchat

MSe1969 · Feb 11, 2019

Stupidshark12 said:
Hi, loving the ROM so far.

Thanks

Stupidshark12 said:
A question: is it possible to get SafetyNet passing with at least basic integrity (if not CTS) with the microg included, or is this a lost cause?
I've heard SN has been spotty with microg in general lately, wondering if anyone has had luck on this ROM.
I'm using Magisk and the DroidGuard Helper from f-droid, but I'm willing to drop everything if I can get this working. I can't live without Snapchat

Well, not an easy question to answer.
Short answer:
I can't do anything about it.

Longer answer:
Maybe you could to do some researches and try-flashes on your side:
Does SN also fail with an "official lineageos4microg" ROM? Does it even fail with an official LineageOS build and pico or nano Gapps?
This should help to isolate your issue, whether it is related to a) the OP3T device + LieageOS as such, b) microG or c) my build in particular
If it relates to LineageOS as such, there is nothing we can do right now. If it relates to microG, you can basically only hope that the guys behind microG will find a solution.
If it really relates to my build in particular (I don't think so, but I can't 100% exclude that possibility), then the "official lineageos4microg" ROM might be the better alternative for you, especially if you "can't live without Snapchat"

What you could also try (I have no clue whether it'll work, but if you don't try, you won't get an answer):
- Try without droidguard installed
- Appy 'MagiskHide' also to the droidguard app
- Build a droidguard apk including this (not yet merged) pull request

Regards, M.

EDIT:
"Build a droidguard apk including this (not yet merged) pull request"
>> This one I could indeed give a try . . .

MSe1969 · Feb 12, 2019

Good news regarding SafetyNet

Stupidshark12 said:
Hi, loving the ROM so far.

A question: is it possible to get SafetyNet passing with at least basic integrity (if not CTS) with the microg included, or is this a lost cause?
I've heard SN has been spotty with microg in general lately, wondering if anyone has had luck on this ROM.
I'm using Magisk and the DroidGuard Helper from f-droid, but I'm willing to drop everything if I can get this working. I can't live without Snapchat

Hi, I think I have good news:
I was able to create a test build with a prebuild and pre-installed RemoteDroidGuard (including the discussed pull request within the microG project).
When I disable root access ("official" LineageOS root addon), the SN test app from Play store shows full compliance.
I have uploaded the test build here
Please perform a test on your end and tell me, how it went. If all goes well, I'll publish a new build.
(Note: If you use Magisk 18.x, you may need to apply Magisk Hide also to the "microG DroidGuard helper app")

Regards, M.

Stupidshark12 · Feb 12, 2019

MSe1969 said:
Hi, I think I have good news:
I was able to create a test build with a prebuild and pre-installed RemoteDroidGuard (including the discussed pull request within the microG project).
When I disable root access ("official" LineageOS root addon), the SN test app from Play store shows full compliance.
I have uploaded the test build here
Please perform a test on your end and tell me, how it went. If all goes well, I'll publish a new build.
(Note: If you use Magisk 18.x, you may need to apply Magisk Hide also to the "microG DroidGuard helper app")

Regards, M.

It works! Magisk manager hidden and MagiskHide enabled on the DroidGuard Helper and the SN attest app. Both Basic Integrity and CTS profile pass!
Using Magisk 18.1 and the 2019-02-12 test build.

This just became my daily driver, thanks for all the hard work.

eightfiveseven · Feb 13, 2019

Hi

I'm getting some really weird behavior after the new february build. Sometimes phone just gets stuck and and when I reboot it goes sometimes as far as unlocking decryption and then black screen and white information led lit and sometimes not even that far.
And then I have to reboot again and maybe after 2-3 reboot phone will boot correctly.

Also yesterday I booted to recovery and adb devices showed me device offline.
Yet again few reboots and got it working.
And iptables script blocking spotify again even when its on whitelist.

Should I just clean install feb build and use something like titanium backup to recover apps?

MSe1969 · Feb 13, 2019

eightfiveseven said:
Hi

I'm getting some really weird behavior after the new february build. Sometimes phone just gets stuck and and when I reboot it goes sometimes as far as unlocking decryption and then black screen and white information led lit and sometimes not even that far.
And then I have to reboot again and maybe after 2-3 reboot phone will boot correctly.

Also yesterday I booted to recovery and adb devices showed me device offline.
Yet again few reboots and got it working.
And iptables script blocking spotify again even when its on whitelist.

Should I just clean install feb build and use something like titanium backup to recover apps?

Thanks for reporting this! I remember having once had such an issue in the middle of Feb testing, but it vanished after one reboot, so I somehow saw it due to a "dirty test build".
But now, after having read your report, I was able to reproduce the behavior - when I tested everything, I never wiped cache & dalvik (not necessary). Now, I explicitly rebooted to recovery to only wipe cache&dalvik and rebooted, and I had a similar ****ty behavior! And always the same after wiping cache/dalvik (this also explains, why it starts to be okay after some reboots).
So I have now reset the three last commits for the kernel and it looks better now. I'll upload the new build, which now also contains the fixed SafetyNet stuff, and will put a new link into the OP.

Seems I will need to priotize 'upstreaming' the kernel as @mumapizza has asked in this thread a couple of posts before . . .

Regarding the iptables blocking script:
You are aware that after flashing an update, your edits in the script are gone and need to be re-applied?

Regards, M.

MSe1969 · Feb 13, 2019

mumapizza said:
Hi, could you please merge linux stable into this kernel. We have an up to date linage15.1 tree from @nathanchance here: https://github.com/android-linux-stable/op3/commits/lineage-15.1

Coming back to that topic (see my last post):
Is the linked kernel tree "ready to use out of the box"?

EDIT: I gave it a try and it looks good - will test it the next days and if all goes well, this will be the kernel from next release onwards

eightfiveseven · Feb 13, 2019

MSe1969 said:
Regarding the iptables blocking script:
You are aware that after flashing an update, your edits in the script are gone and need to be re-applied?

Regards, M.

Now when you said it of course it makes sense

. Gonna edit that again..

MSe1969 · Feb 13, 2019

New build available

Hi all,
a new build with kernel fix (reverted 3 last commits) and pre-installed microG Droid Guard helper app to pass SafetyNet attestation (if used w/o root/Xposed) is available:
https://www.androidfilehost.com/?fid=1395089523397892144

Regards, M.

[CLOSED] EOL [ROM][Unofficial][8.1.0][microG][signed]hardened LineageOS 15.1 for Oneplus 3T

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Member

Senior Member

Senior Member

Senior Member

Senior Member

New member

Senior Member

Senior Member

New member

Member

Senior Member

Senior Member

Member

Senior Member

Attachments

Similar threads

Top Liked Posts