[Sony Xperia XZ Premium ROMs, Kernels, Recoveries, ] LSS4181:
Status on cr-7.0?

It seems the sources on GitHub aren't up to date for building cr-7.0, so I cherrypicked all open upstream commits so far in the device trees (maple, yoshino-common, common-treble) and I'm able to build a bit further. I'm not sure if there are any other open commits (on other projects) needed to be cherrypicked (and it'd be better if there are convenient ways to pick all the needed ones at once, as it's quite an endeavor to cherry pick every single commit one by one).

Currently I can build up to some sepolicy-related errors (at 28757/92012, just before building the kernel). Actually, one of the cherrypicked commits mentioned something about disabling selinux for the time being, so I'm not sure if there are still fixes needed on that part as it's very likely the errors are related.

/out/target/product/maple/obj/ETC/sepolicy.recovery_intermediates/sepolicy

libsepol.report_failure: neverallow on line 1397 of system/sepolicy/public/domain.te (or line 11017 of policy.conf) violated by allow zygote cgroup:file { create };
libsepol.report_failure: neverallow on line 1383 of system/sepolicy/public/domain.te (or line 11003 of policy.conf) violated by allow update_engine update_engine:capability { dac_read_search };
libsepol.report_failure: neverallow on line 1382 of system/sepolicy/public/domain.te (or line 11002 of policy.conf) violated by allow update_engine update_engine:capability { dac_override };
libsepol.report_failure: neverallow on line 1382 of system/sepolicy/public/domain.te (or line 11002 of policy.conf) violated by allow sysinit sysinit:capability { dac_override };
libsepol.report_failure: neverallow on line 1178 of system/sepolicy/public/domain.te (or line 10808 of policy.conf) violated by allow update_engine system_data_file:file { write create setattr append unlink rename };
libsepol.report_failure: neverallow on line 500 of system/sepolicy/public/domain.te (or line 10457 of policy.conf) violated by allow update_engine rootfs:file { write create setattr relabelto append unlink rename };
libsepol.report_failure: neverallow on line 493 of system/sepolicy/public/domain.te (or line 10450 of policy.conf) violated by allow update_engine system_file:file { relabelto };
libsepol.report_failure: neverallow on line 491 of system/sepolicy/public/domain.te (or line 10448 of policy.conf) violated by allow update_engine system_file:lnk_file { write create setattr append unlink rename };
libsepol.report_failure: neverallow on line 491 of system/sepolicy/public/domain.te (or line 10448 of policy.conf) violated by allow update_engine system_file:file { write create setattr relabelfrom append unlink rename };
libsepol.report_failure: neverallow on line 491 of system/sepolicy/public/domain.te (or line 10448 of policy.conf) violated by allow update_engine system_file:dir { write create setattr rename };
libsepol.check_assertions: 10 neverallow failures occurred
Error while expanding policy

out/target/product/maple/obj/ETC/sepolicy_neverallows_intermediates/policy.conf

libsepol.report_failure: neverallow on line 1397 of system/sepolicy/public/domain.te (or line 11651 of policy.conf) violated by allow zygote cgroup:file { create };
libsepol.report_failure: neverallow on line 1383 of system/sepolicy/public/domain.te (or line 11637 of policy.conf) violated by allow update_engine update_engine:capability { dac_read_search };
libsepol.report_failure: neverallow on line 1382 of system/sepolicy/public/domain.te (or line 11636 of policy.conf) violated by allow update_engine update_engine:capability { dac_override };
libsepol.report_failure: neverallow on line 1178 of system/sepolicy/public/domain.te (or line 11421 of policy.conf) violated by allow update_engine system_data_file:file { write create setattr append unlink rename };
libsepol.report_failure: neverallow on line 500 of system/sepolicy/public/domain.te (or line 10343 of policy.conf) violated by allow update_engine rootfs:file { write create setattr relabelto append unlink rename };
libsepol.report_failure: neverallow on line 493 of system/sepolicy/public/domain.te (or line 10336 of policy.conf) violated by allow update_engine system_file:file { relabelto };
libsepol.report_failure: neverallow on line 491 of system/sepolicy/public/domain.te (or line 10334 of policy.conf) violated by allow update_engine system_file:lnk_file { write create setattr append unlink rename };
libsepol.report_failure: neverallow on line 491 of system/sepolicy/public/domain.te (or line 10334 of policy.conf) violated by allow update_engine system_file:file { write create setattr relabelfrom append unlink rename };
libsepol.report_failure: neverallow on line 491 of system/sepolicy/public/domain.te (or line 10334 of policy.conf) violated by allow update_engine system_file:dir { write create setattr rename };
libsepol.report_failure: neverallow on line 326 of system/sepolicy/public/domain.te (or line 10169 of policy.conf) violated by allow update_engine update_engine:capability { sys_rawio };
libsepol.check_assertions: 10 neverallow failures occurred
Error while expanding policy

Will be looking if there are already any open commits addressed them.

On the other hand, would a 4.9-based kernel be needed in order to get a functional cr-7.0 build for the time being? With current kernel (4.4), there shouldn't be any issues with building, as the kernel repo can be built just fine with cr-6.1, and there weren't any breaking changes on the cr-7.0 branch.

EDIT: Commenting out the offending sepolicies allowed me to build even further until this point.

external/tinycompress/compress.c:142:13: error: unused function '_is_codec_supported' [-Werror,-Wunused-function]
static bool _is_codec_supported(struct compress *compress, struct compr_config *config,
^
1 error generated.

EDIT 2: Commenting out the "unused function" allowed building even further, up to this point. (build directory replaced with <build_dir> here)

This might be related to the offending sepolicy lines I commented out previously.

neverallow check failed at <build_dir>/out/target/product/maple/obj/ETC/plat_sepolicy.cil_intermediates/plat_sepolicy.cil:12721 from system/sepolicy/private/domain.te:31
(neverallow base_typeattr_305 sysfs (file (ioctl read write create setattr lock relabelfrom append unlink link rename open)))
<root>
allow at <build_dir>/out/target/product/maple/obj/ETC/plat_sepolicy.cil_intermediates/plat_sepolicy.cil:16269
(allow sysinit sysfs (file (ioctl read write getattr lock append map open)))

neverallow check failed at <build_dir>/out/target/product/maple/obj/ETC/plat_sepolicy.cil_intermediates/plat_sepolicy.cil:6150 from system/sepolicy/public/domain.te:809
(neverallow base_typeattr_114 base_typeattr_115 (file (create setattr lock relabelfrom relabelto map unlink link rename execute quotaon mounton execute_no_trans entrypoint execmod open audit_access)))
<root>
allow at <build_dir>/out/target/product/maple/obj/ETC/plat_sepolicy.cil_intermediates/plat_sepolicy.cil:16268
(allow sysinit userinit_data_exec (file (ioctl read getattr lock relabelto map open)))

EDIT 3: Commenting out the problematic entries in the respective te files of the errors above allowed some further compilation, but I'm stopped by another. It seems this "userinit_data_exec" one is a complicated one that I cannot just disable it. I'm not experienced in sepolicies, but given this many problems it seems there are still a good amount of work needed to get the sepolicies working. So far was able to build up to 70-80% of the code (about 21000 left).