[GUIDE] Re-locking the bootloader on the OnePlus 8t with a self-signed build of LOS 18.1

[WhitbyGreg]

Answering myself: No. System avb flags create a chain system signing so that system could be updated independently, but with a key that is known to vbmeta partition. So, if user modifyes system, that prlbably would not work. I am looking for a way to let users flash Gapps without trigerring rejection.

Short answer: no

Longer answer: kinda... but it would break the security model and make relocking the bootloader pointless.

Basically, yes you might be able to create an empty vbmeta and relock the bootloader, but then any changes to any of the partitions would be valid. So if malware exploited a hole that allowed it to write to system (or vendor or any other partition), any changes would be kept through a reboot or even a system reset.

As for adding GAPPS "afterwards", you could then create your own build of GAPPS and sign it with the same key as you signed your build and allow users to flash it as part of install. Or simply create two separate distros of your ROM, one without GAPPS and one with, as you can certainly build GAPPS into a build.

 

[optimumpro]

Short answer: no

Longer answer: kinda... but it would break the security model and make relocking the bootloader pointless.

Basically, yes you might be able to create an empty vbmeta and relock the bootloader, but then any changes to any of the partitions would be valid. So if malware exploited a hole that allowed it to write to system (or vendor or any other partition), any changes would be kept through a reboot or even a system reset.

As for adding GAPPS "afterwards", you could then create your own build of GAPPS and sign it with the same key as you signed your build and allow users to flash it as part of install. Or simply create two separate distros of your ROM, one without GAPPS and one with, as you can certainly build GAPPS into a build.

Well. You can't bundle Gapps into the build - licensing issue. Second, have you tried to modify System partition and boot? Guess what, I did, and it booted. Turns out chaining is the way to be able to modify partitions independently without touching vbmeta. Here is what Google says about it:

"Note that the hash-tree descriptors for system.img, system_ext.img and product.img will be included only in vbmeta_system.img, but not vbmeta.img. With the above setup, partitions system.img, system_ext.img, product.img and vbmeta_system.img can be updated independently - but as a group - of the rest of the partitions, or as part of the traditional updates that update all the partitions."

So, when you create a chain, it turns out that the chained partitions are wide open (of course subject to root and sepolicy rights).

 

[optimumpro]

Well. You can't bundle Gapps into the build - licensing issue. Second, have you tried to modify System partition and boot? Guess what, I did, and it booted. Turns out chaining is the way to be able to modify partitions independently without touching vbmeta. Here is what Google says about it:


"Note that the hash-tree descriptors for system.img, system_ext.img and product.img will be included only in vbmeta_system.img, but not vbmeta.img. With the above setup, partitions system.img, system_ext.img, product.img and vbmeta_system.img can be updated independently - but as a group - of the rest of the partitions, or as part of the traditional updates that update all the partitions."

So, when you create a chain, it turns out that the chained partitions are wide open (of course subject to root and sepolicy).

Actually, removal of 'BOARD_AVB_VBMETA_SYSTEM' flags broke the build. And it makes sense. System partition gets modified constantly by system processes and apps, so it would be impossible to keep it unchanged. You tick toggles, make adjustments, and all those things modify system... .

 

[WhitbyGreg]

Well. You can't bundle Gapps into the build - licensing issue.

Technically even just downloading GAPPS and installing it seperatly is an licensing issue.. so

Second, have you tried to modify System partition and boot? Guess what, I did, and it booted.

I have, and it did boot but it rolled back the changes (as it should).

Turns out chaining is the way to be able to modify partitions independently without touching vbmeta. Here is what Google says about it:

"Note that the hash-tree descriptors for system.img, system_ext.img and product.img will be included only in vbmeta_system.img, but not vbmeta.img. With the above setup, partitions system.img, system_ext.img, product.img and vbmeta_system.img can be updated independently - but as a group - of the rest of the partitions, or as part of the traditional updates that update all the partitions."

So, when you create a chain, it turns out that the chained partitions are wide open (of course subject to root and sepolicy rights).

Yes, but you have to update the vbmeta_system.img at the same time that has to be signed with the same key as vbmeta, so you can't just change those partitions willy nilly.

Actually, removal of 'BOARD_AVB_VBMETA_SYSTEM' flags broke the build. And it makes sense. System partition gets modified constantly by system processes and apps, so it would be impossible to keep it unchanged. You tick toggles, make adjustments, and all those things modify system... .

My build is working fine without the "BOARD_AVB_MAKE_VBMETA_IMAGE_ARGS" flags, I've removed both "--set_hashtree_disabled_flag" and "--flags 2".

 

[optimumpro]

Technically even just downloading GAPPS and installing it seperatly is an licensing issue.. so

I have, and it did boot but it rolled back the changes (as it should).


Yes, but you have to update the vbmeta_system.img at the same time that has to be signed with the same key as vbmeta, so you can't just change those partitions willy nilly.

My build is working fine without the "BOARD_AVB_MAKE_VBMETA_IMAGE_ARGS" flags, I've removed both "--set_hashtree_disabled_flag" and "--flags 2".

I was talking about BOARD_AVB_VBMETA_SYSTEM, not VBMETA_IMAGE flags. When I removed the former, the build stopped and asked for VBMETA_SYSTEM.

And it's not clear to me, as users make plenty of prebuilt changes that modify system, and they don't get rolled back on reboot.

Any way, how would I sign let's say a GAPPS zip? I have never signed anything independently of the build. And which signature? BOAD_AVB? That's the one that goes into VBMETA. BOARD_AVB_VBMETA_SYSTEM? Probably the rom signing key, which is different? But wouldn't that zip have to modify VBMETA_SYSTEM? How? And what's the command to sign let's say GAPPS.zip?.

 

[WhitbyGreg]

I was talking about BOARD_AVB_VBMETA_SYSTEM, not VBMETA_IMAGE flags. When I removed the former, the build stopped and asked for VBMETA_SYSTEM.

And it's not clear to me, as users make plenty of prebuilt changes that modify system, and they don't get rolled back on reboot.

That's because standard builds of LineageOS have "--set_hashtree_disabled_flag", which basically turns off the hashtree, and "--flags 2" which tells the system not to rollback changes.

Any way, how would I sign let's say a GAPPS zip? I have never signed anything independently of the build. And which signature? BOAD_AVB? That's the one that goes into VBMETA. BOARD_AVB_VBMETA_SYSTEM? Probably the rom signing key, which is different? But wouldn't that zip have to modify VBMETA_SYSTEM? How? And what's the command to sign let's say GAPPS.zip?.

I wouldn't bother trying to independently sign a GAPPS package, instead going for the pre-built OS/GAPPS route which is relativly easy. However you should be able to sign GAPPS with signapk if you really wanted to try it. As for which key, it should be the releasekey.

 

[optimumpro]

That's because standard builds of LineageOS have "--set_hashtree_disabled_flag", which basically turns off the hashtree, and "--flags 2" which tells the system not to rollback changes.

I wouldn't bother trying to independently sign a GAPPS package, instead going for the pre-built OS/GAPPS route which is relativly easy. However you should be able to sign GAPPS with signapk if you really wanted to try it. As for which key, it should be the releasekey.

When Cyanogen bundled Gapps, they got a cease and desist letter from Google. Also, even if I sign Gapps.zip with the release key, system would still be modified.

My rom doesn't have "--flags 2". Yet I still don't understand how it is possible that user changes to system (even when they change brightness or move volume panel or a hundred of other changes) don't get to roll back.

 

[WhitbyGreg]

When Cyanogen bundled Gapps, they got a cease and desist letter from Google. Also, even if I sign Gapps.zip with the release key, system would still be modified.

Yep, it's a risk, there are several custom ROM's that do ship GAPPS though. I completely understand (and agree with) why LineageOS doesn't ship GAPPS, both from a licensing perspective and a user choice perspective.

I still don't understand how it is possible that user changes to system (even when they change brightness or move volume panel or a hundred of other changes) don't get to roll back.

Because those aren't stored on the system partition, those are part of the user data or in memory. The system partition is not written to during day to day operations, and in fact on Android 11 is only mounted as read only.

 

[optimumpro]

Yep, it's a risk, there are several custom ROM's that do ship GAPPS though. I completely understand (and agree with) why LineageOS doesn't ship GAPPS, both from a licensing perspective and a user choice perspective.


Because those aren't stored on the system partition, those are part of the user data or in memory. The system partition is not written to during day to day operations, and in fact on Android 11 is only mounted as read only.

I think in my case it is magisk that's doing it, as nothing gets rolled back on my phone. I guess for my users I can do --flag 2, so they can install Gapps themselves.

Gapps: I think there was a class action case years ago which resulted in a court approved settlement that allowed users to install Gapps, but no bundling with releases by developers.

 

[optimumpro]

Yep, it's a risk, there are several custom ROM's that do ship GAPPS though. I completely understand (and agree with) why LineageOS doesn't ship GAPPS, both from a licensing perspective and a user choice perspective.


Because those aren't stored on the system partition, those are part of the user data or in memory. The system partition is not written to during day to day operations, and in fact on Android 11 is only mounted as read only.

Here is what Magisk script does during the final stages of the build:

Remove pattern [,avb=vbmeta_system]
Remove pattern [,avb]

 

[YulNicolai]

Can anyone share their persist.img file? My fingerprint is not working. (OnePlus 8T KB2001 India)

 

[WhitbyGreg]

Can anyone share their persist.img file? My fingerprint is not working. (OnePlus 8T KB2001 India)

Did it stop working after you relocked your bootloader? If so you'll need to apply this patch to your build.

 

[YulNicolai]

Did it stop working after you relocked your bootloader? If so you'll need to apply this patch to your build.

I do not understand how to use this patch.

 

[WhitbyGreg]

I do not understand how to use this patch.

It applys the sed command to two of extracted libraries from the phone (or in the muppets if your using that). After makeing the change you can recompile LineageOS and update your phone with the new software and your finger print reader should work again.

 

[YulNicolai]

It applys the sed command to two of extracted libraries from the phone (or in the muppets if your using that). After makeing the change you can recompile LineageOS and update your phone with the new software and your finger print reader should work again.

Does this work with oxygenos? My fingerprint does not work on my oxygenos either. The problem is with persist.img.

 

[xstefen]

It's not the hal. The blob 'libgf_g6_ud_hal.so' doesn't get built from source, where you can make modifications It's a proprietary vendor blob supplied by Oneplus. All we can do is try a similar blob from other devices or just remove it. By the way, Oneplus 9 vendor doesn't have this blob, so, it is possible that it's not needed at all.

late reply:

device_oneplus_sm8250-common/extract-files.sh at c648c8f78e52165ba3a7982e6bed252d3483c172 · Evolution-X-Devices/device_oneplus_sm8250-common

Common tree for OnePlus 8 Series. Contribute to Evolution-X-Devices/device_oneplus_sm8250-common development by creating an account on GitHub.

github.com

 

[WhitbyGreg]

Does this work with oxygenos? My fingerprint does not work on my oxygenos either. The problem is with persist.img.

No, this only applies to a custom OS like Lineage. Try using MSM to restore to stock. Otherwise you'll need to start your own thread if you are still having issues.

 

[antonyjr]

No, this only applies to a custom OS like Lineage. Try using MSM to restore to stock. Otherwise you'll need to start your own thread if you are still having issues.

I'm trying to build lineage os 18.1 for oneplus 6 (enchilada) with opengapps. What I understand is that, I have to build Open GAPPS when I build lineage OS which I saw how to do in the opengapps github repo. So I just build opengapps along with lineage 18.1 and that's all (from this -> https://github.com/opengapps/aosp_build). No other changes required? Right? This way I can use gapps and no sign issues?

 

[WhitbyGreg]

I'm trying to build lineage os 18.1 for oneplus 6 (enchilada) with opengapps. What I understand is that, I have to build Open GAPPS when I build lineage OS which I saw how to do in the opengapps github repo. So I just build opengapps along with lineage 18.1 and that's all (from this -> https://github.com/opengapps/aosp_build). No other changes required? Right? This way I can use gapps and no sign issues?

Correct, just add them into the build system and you'll have a signed install file at the end that includes GAPPS.

 

[antonyjr]

Correct, just add them into the build system and you'll have a signed install file at the end that includes GAPPS.

Thank you for the reply. I've built lineage os in the past from source. This is exciting to use lineage os with a locked bootloader with my own signing keys. How exciting.

From what I can see is that, I really can't release these builds from github actions into my github repo which would be illegal. So how do you update your builds without a public build system. Do you build locally all the time and update it yourself? So I would have to rebuild the lineage os from source every once in a while.