yashsingh1/xdaforums huggingface dataset:
[OnePlus 3T ROMs, Kernels, Recoveries, & Other Deve] MSe1969:
Thanks for the positive general feedback.

I know XING, but I don't know their app. Without having any more details, I guess from your posting and the fact, that this app asks for permission to edit contacts, that it tries to directly update the contacts (and not to e.g. write an export file). You gave the contacts permission and also did not restrict the contacts access in the privacy guard, correct?

I can't give any app support, my "quick shot" as a guess would be, that there is either some bug in this app (some folks complain in the reviews on Playstore about this app crashing for misc. other reasons, too) and/or this app uses some rather "unusual" way for contacts editing instead of the regular Android APIs. If you could somehow produce a log, it would be helpful.
[OnePlus 3T ROMs, Kernels, Recoveries, & Other Deve] kHAW17:
I'm not quite sure how to open the privacy guard unless it's in the settings. (I sometimes don't know what's the correct translation 'cause my menu is in german).

Anyways, the log is attached as zip. Hope it works.
[OnePlus 3T ROMs, Kernels, Recoveries, & Other Deve] MSe1969:
Privacy Guard:

Settings - Security & Privacy - Trust - Privacy Guard

(Einstellungen - Sicherheit & Datenschutz - Trust - Datenschutz) :)

Thanks for the log. As already stated before, I can't and I won't provide any app support, but the below snippet (one of several) gives some indications.

03-02 16:51:54.523 E/ActivityThread( 5566): Failed to find provider info for com.facebook.katana.provider.AttributionIdProvider
03-02 16:51:54.594 E/AndroidRuntime( 5566): FATAL EXCEPTION: main
03-02 16:51:54.594 E/AndroidRuntime( 5566): Process: com.xing.android, PID: 5566
03-02 16:51:54.594 E/AndroidRuntime( 5566): android.app.RemoteServiceException: Bad notification for startForeground: java.lang.RuntimeException: invalid channel for service notification: Notification(channel=notification_default_channel_id pri=0 contentView=null vibrate=null sound=null defaults=0x0 flags=0x42 color=0xff007575 vis=PRIVATE)
03-02 16:51:54.594 E/AndroidRuntime( 5566):	at android.app.ActivityThread$H.handleMessage(ActivityThread.java:1768)
03-02 16:51:54.594 E/AndroidRuntime( 5566):	at android.os.Handler.dispatchMessage(Handler.java:106)
03-02 16:51:54.594 E/AndroidRuntime( 5566):	at android.os.Looper.loop(Looper.java:164)
03-02 16:51:54.594 E/AndroidRuntime( 5566):	at android.app.ActivityThread.main(ActivityThread.java:6494)
03-02 16:51:54.594 E/AndroidRuntime( 5566):	at java.lang.reflect.Method.invoke(Native Method)
03-02 16:51:54.594 E/AndroidRuntime( 5566):	at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:440)
03-02 16:51:54.594 E/AndroidRuntime( 5566):	at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:807)

This is what I personally think:

1. The Bad notification for startForeground exception is e.g. explained here. It can't however be an Oreo-related general problem of the app, because this app seems to run in general on Oreo.

2. However, Failed to find provider info for com.facebook.katana.provider.AttributionIdProvider pitches all alarm bells for me: The XING app seems to make use of the FaceBook SDK (a reason for me not to use an app at all). Either, the SDK can't "phone home" (e.g. because you have activated the Google/FB blocking script in my ROM) and/or it makes use of certain original Google play services functionality, which hasn't been ported to microG.

=> Anyway, I can't help here - but you can still export contacts via Web as vCards, I think.

Regards, M.
[OnePlus 3T ROMs, Kernels, Recoveries, & Other Deve] kHAW17:
This is a very good hint, thank you. :)
[OnePlus 3T ROMs, Kernels, Recoveries, & Other Deve] benp12:
Hey man, just wondering if you have any intention of doing an update for lineage os 16? Lineage Os 16 micro G version was just released in the last few hours. Cheers
[OnePlus 3T ROMs, Kernels, Recoveries, & Other Deve] MSe1969:
Eventually, yes - it will take however some time to test and apply the features of this build, so not immediately, but I have already started to create a new organization on github. Earliest next month.

Will soon upload an update for this build, first.
[OnePlus 3T ROMs, Kernels, Recoveries, & Other Deve] benp12:
Awesome!! Yeah, no worries on the timing, was just wondering if you had thoughts in that direction. Thanks man.
[OnePlus 3T ROMs, Kernels, Recoveries, & Other Deve] MSe1969:
New build with March ASB patches

Hi all,

a new build with March 2019 security patches is available for download:

https://www.androidfilehost.com/?fid=1395089523397912970

ASB Security string 2019-03-05

SystemWebView: M73-Bromite (includes CVE-2019-5786)

Kernel: Upstreamed to 3.18.136

Happy flashing,

regards, M.
[OnePlus 3T ROMs, Kernels, Recoveries, & Other Deve] anupritaisno1:
Btw you're missing several security patches from the ASB

Example: https://git.kernel.org/pub/scm/linu.../?id=7bada55ab50697861eee6bb7d60b41e68a961a9c

These are present in the ASB but not on your kernel (I checked the branch in your build manifest)

There might be even more patches you're missing from prior ASBs. Take a look first
[OnePlus 3T ROMs, Kernels, Recoveries, & Other Deve] MSe1969:
I indeed "took a look first", to quote your advice!

In general, the ASB patches showing the 5th as date are device-dependent, which means, that they do not apply to every device. The kernel of this ROM is a 3.18 kernel, whilst the ASB shows updates for the 4.14 kernel. The 3.18 Kernel in this build contains the latest Linux kernel.org 3.10.136 tag from February 2019. The commits you are referring to are from 2018 and even 2017. If these aren't part of the latest 2019 release of the 3.18 kernel, then this has a reason, and I think the Linux kernel specialists know better than you or me what to include in their LTS releases. You won't find those in the official LineageOS kernel either.
[OnePlus 3T ROMs, Kernels, Recoveries, & Other Deve] anupritaisno1:
Then I'm afraid you should check again

The fix was added in Google's 3.18 common kernel all the way back in December and is present in lineage's "android_kernel_qcom_msm8996" repository

Check:

https://github.com/GlassROM-devices.../commits/lineage-16.0/drivers/staging/android

The fix was added during an upstream merge which means it is present in the upstream kernels
[OnePlus 3T ROMs, Kernels, Recoveries, & Other Deve] MSe1969:
Thanks for the details - you have made a valid point for the binder commit, which is part of the 3.18 March ASB tag of the Google common kernel. I'll add it in my next build. I see that you have edited your previous message and removed the other commit, so we are in agreement on that one. Will also have a closer look on the common kernel.
[OnePlus 3T ROMs, Kernels, Recoveries, & Other Deve] anupritaisno1:
You can just use the kernel I linked you to. It has everything that could be upstreamed to the latest already upstreamed to the latest

Btw I find a few more things that I'd like to ask

Why is a hardened build using userdebug and not user as the build variant? User triggers stricter sepolicy checks and removes a lot of code from the final build thus reducing the attack surface

Are you really sure you want to sign the ROM with dev-keys and not release-keys? This might be an error because you can simply specify a flag in boardconfig to use dev-keys instead of using post build signing

Edit: confirmed that post build signing was used
[OnePlus 3T ROMs, Kernels, Recoveries, & Other Deve] MSe1969:
Hi,

regarding the kernel:

The linked kernel's branch with all the good stuff is 'lineage-16.0' - as far as I can see, it is based on the LineageOS' 'lineage-16.0' branch, which means, that it contains specific caf-tags optimized for android 9, so difficult to "simply use it" on lineage-15.1 : Despite following the respective instructions e.g. published here on XDA, my experiences in trying to merge caf tags weren't that good - the merges went without problems, but the resulting kernel was a mess.

But I have made a note of this kernel and it will serve me as a reference and I'll definitely be grateful to pick additional commits.

EDIT: When I start to provide lineage-16.0 based builds, I will make use of your kernel.

regarding signing:

I use the same method as the lineageos4microg project. I tried first to use the officially documented method to create a 'dist' build and then run the two scripts to unpack dist and sign. Issue was, that randomly, the 2nd script aborted and I did not find any solution. And when it failed, there was no way to make it work other than changing some "noop" thing in the build tree, repeating 'make dist' and hoping for the best :(

The current used method always works and the result in fact isn't really different: The important thing is, that all delivered apps (of course except for the pre-signed ones) have a dedicated signature and are not signed with the publicly known test-keys - the "dev-keys" indication, as far as I see it, is just "cosmetics".

EDIT: See here

regarding userdebug:

The main difference between userdebug and user builds - at least in LineageOS (AOSP may have many more additional differences) - are two areas:

1. userdebug allows 'adb root' (if allowed in the dev. options) and the LIneageOS root addon does not work in user builds (I know: One could still use Magisk or some closed-source root 'solutions' . . .)

2. Certain trace/logging options are not available without userdebug

That is why I use it. As far as I see it, different from AOSP, the userdebug flavor in LineageOS isn't that 'bad' - it is the default for LineageOS builds and hence already adapted to be suitable as a release build.

EDIT: How do you deal with this topic in GlassROM?

Regards, M.
[OnePlus 3T ROMs, Kernels, Recoveries, & Other Deve] anupritaisno1:
If you make use of that kernel please take care of the dm-verity commit https://github.com/GlassROM-devices...mmit/005ace2a5cc4c2c96fd2e4e92155e0973bd59357 else boot will fail as dm-verity cannot be setup for system

https://github.com/GlassROM-devices...mmit/765331c29b89350810bba515e81c0dc44fb25b7e

This won't allow setting selinux to permissive. You might want to revert this if it's unnecessary. Note that even chainfire recommends against setting selinux to permissive (refer: https://su.chainfire.eu). The proper way is to inject sepolicy at runtime which most mods these days already do

As for the user build topic: glassrom has a strict charter that mandates all release builds to be shipped as user. If for some reason user builds are no longer possible when moving to a newer android version then that device cannot move to that version and will always stay on the older version. Userdebug and eng builds must also be signed with a key different from the one used on release builds. Security patches must also fix all kernel issues to satisfy the ASB before declaring a higher security patch
[OnePlus 3T ROMs, Kernels, Recoveries, & Other Deve] anupritaisno1:
[MENTION=7929484]MSe1969[/MENTION] actually I do have something that's confusing me

Lineageos 16 added a toggle to deny insertion of new usb devices

However a few things do not make sense to me at all:

This toggle is disabled by default

The user must manually enable the toggle

The data that says "enable this setting" is stored on /data

The problem is:

Assume encrypted, /data will be available very late during the boot process

The kernel will find and "allow" the malicious USB device before /data is up and the early init environment does not deny these by default

Impact: a "malicious" USB can theoretically be connected to a device and then the device could be forced to reboot. During init this denial setting is not set and the USB drive is accepted

This means that you can technically make a device accept a malicious USB drive by forcing it to reboot and the protection provided by deny_new_usb is useless

What are your thoughts?

According to me, the fix is to set deny_new_usb=1 in the kernel and change it to 0 during late-fs
[OnePlus 3T ROMs, Kernels, Recoveries, & Other Deve] enkidu70:
I just installed this rom and need to use Google Play Store because of some payed apps.

So I installed Phonesky (https://shadow53.com/android/downloads/microg/#google-play-store-standalone, patched) and microG self-test shows all green.

But when I open Play Store, I only get an error from server: DF-DFERH-01

I already deleted gmail account and reattached it, cleared Play Store data ecc. But error persists.

Currently, there is not really installed anything on the phone. Installing Play Store was one of the first steps.

It is no problem to wipe it again, if I shall do it in a different way!?

Please help!

Tnx in advance,

Enkidu
[OnePlus 3T ROMs, Kernels, Recoveries, & Other Deve] MSe1969:
From a general technical standpoint, I think you are right.

The Kernel patch patch applied in LineageOS 16.0 originates from 'grsecurity'. There, it is also explained, that "For greatest effectiveness, this sysctl should be set after any relevant init scripts."

I think it is defaulted in the kernel not to be set to have some "modular independency" - otherwise, the kernel would never allow any new USB connections unless you put specific additional entries e.g. into the init scripts of your OS, maybe not the best idea . . . - I would rather put into init.rc or init.usb.rc (system/core) at a very early stage a statement to switch it off by directly writing to /proc/sys/kernel/deny_new_usb and at a later stage, once the encrypted /data has been decrypted, read and set the proper value. . . ?

I haven't yet looked at the functionality in LineageOS 16.0 (and I don't want to backup my LineageOS 15.1 now in order to flash Lineage 16.0, but I will look next time, when I continue working on LineageOS 16.0), but - different from e.g. CopperheadOS, where you can easily find the commits in the Settings app and in system/core, where init.rc picks the respective property - when grep'ing the commit history and/or the code of Settings, base or core in LineageOS 16, it seems that right now, there is only that kernel patch, nothing in the device-independent code yet? To me it seems right now, that this feature isn't implemented, yet?
[OnePlus 3T ROMs, Kernels, Recoveries, & Other Deve] anupritaisno1:
The feature has been implemented as part of "Trust" and is also present in the Trust HAL

Do people actually use USB devices on android while it's booting?

Also init should not set it to 1. The kernel should start with it set to 1 is what I meant in the previous post
[OnePlus 3T ROMs, Kernels, Recoveries, & Other Deve] MSe1969:
First of all, the bundled YalpStore also allows you to continue using/updating your purchased apps, given that you use your real credentials to access the Google play store server.

Therefore, as long as you do not need "in-app-purchases" or you have one of those apps doing a license-checking, this should be sufficient. So before messing around with using the "genuine" Playstore app, this option should be considered, first.

Next (assuming you insist on the need of the genuine Phonesky.apk), just make sure that you remove the Fakestore.apk from /system/priv-app - this microG component spoofs the existence of the play store to apps containing Google-libraries. There however can't be two apps claiming to be the Playstore at the same time . . . :)

And last, regarding the option to use the Google Playstore app (whether patched or original does not matter) on top of microG - I have successfully tested this almost two years ago, but I don't really recommend it:

The genuine Phonesky.apk has got a nasty habit: It silently self-updates itself and also the GmsCore.apk everytime, whenever it detects a newer available version! This happens without notification and cannot be configured or influenced. What that means if it attempts to 'replace' microG with the genuine playservices, I wasn't keen on finding out (microG also spoofs a pretty recent play services patch level, so this won't happen for a while, when you use the genuine Phonesky.apk). But it would immediately replace e.g. the patched Phonesky.apk with the most recent original (unless that has also been patched out...?) - if you ask me, this is a recipe for trouble, even if it seems to work at the beginning.
[OnePlus 3T ROMs, Kernels, Recoveries, & Other Deve] enkidu70:
Yes, I originally wanted to do so but was hesitating because of that warning that it is not legal to do so.

I will check. Guess I could run into troubles with APEX Launcher... We'll see.

Flashing Phonesky removed Fakestore...

That's a point...

So is there a way to purchase something without having Play Store installed?

And tnx for your help!

Cheers,

Enkidu
[OnePlus 3T ROMs, Kernels, Recoveries, & Other Deve] MSe1969:
OK, thanks, I see - looked at the wrong place obviously, found it now . . .

I have understood, that you wanted to default the setting to 1 in the kernel already - this is possible, and in the context of LineageOS 16.0 as a whole also consistent (i.e. device boots with deny setting until almost the end of the boot process, when /data is decrypted and the settings are applied accordingly to either continue with that setting or to switch to allow).

My point was, that if you see the kernel as something more "independent" like the grsecurity developers, for whom it is simply the Linux kernel, which can be used for various purposes, the default can only be to allow it.

But thinking about it in the context of being a kernel for LineageOS 16.0 only, a commit to simply set the default to 1 in the kernel could definitely make sense.
[OnePlus 3T ROMs, Kernels, Recoveries, & Other Deve] MSe1969:
Well, microG falls into the same category, so to say - so using the genuine Phonesky.apk on top of microG is also not in line with Google's T&Cs . . .

Only way to find out is to try.

True - just looked at the ZIP file on shadow53's link, it contains instructions to purge FakeStore, YalpStore, any existiong Phonesky etc...

I am afraid that if you would like to continue purchasing further apps, you won't really have a choice than somehow using the genuine Playstore.

Maybe some scenario of using an old phone (w/o SIM card and no real data on it - i.e. no contacts, no messenger, nothing in fact) with Gapps to purchase an app and then access PS via your "real" phone having Yalp for example to access the now purchased app could be considered?
[OnePlus 3T ROMs, Kernels, Recoveries, & Other Deve] enkidu70:
Yes... Was thinking about the same...

At least, I can copy an app by using Titanium, so that's an option... :)

Btw, does https://island.oasisfeng.com/ properly work with this rom?

I just installed it an first thing done was downloading Google Play Services via Yalp!?

Also Yallp shows me there is an update available for Google Play Services!?

I am a bit confused!? :D
[OnePlus 3T ROMs, Kernels, Recoveries, & Other Deve] MSe1969:
DON'T "update" play services! microG spoofs to be Play services, so all apps believe it... Put play services on Yalp's black list instead.

Whether "island" works, I don't know. Try it without "updating" microG...
[OnePlus 3T ROMs, Kernels, Recoveries, & Other Deve] enkidu70:
I thought so... But I setup all to autoupdate...

How can I see if it was done? (Yalp still shows it as available update, but I am not sure if it already tried it...)

---------- Post added at 10:44 AM ---------- Previous post was at 10:26 AM ----------

Is it possible to encrypt the device using this rom?

I tried it (directly after installing this rom) but if fails!?
[OnePlus 3T ROMs, Kernels, Recoveries, & Other Deve] MSe1969:
To your first point: Go to Settings -> Apps and display the microG Services core app details. Scroll down and verify, that the version number starts with 0.2.6 - if you want to be on the safe side, deactivate the app, which uninstalls any update, if present. Afterwards activate again and restart the device.

Regarding encryption: My own device using this ROM is encrypted, so it works.

EDIT:

Of course, make a nandroid backup first.

IMPORTANT: Please update your TWRP by using the link in the official LineageOS instructions (it points to here) - the one on twrp.me, which is still linked in the OP causes much trouble, when you attempt to format the data partition... (see the other OP3T threads - you would normally not do this, but in case you decide to get rid of encryption...)
[OnePlus 3T ROMs, Kernels, Recoveries, & Other Deve] enkidu70:
I did a full wipe just to go for sure! :)

... and also to chek if I get it encrypted. But no way.

I did a full wipe, flashed this rom again, just did the necessary LineageOS steps, went to settings, security, encryption and started it. Android Droid symbol was shown for some seconds, then reboot and just a few seconds later it was up again. Status not encrypted. Tried it a couple of times but no success.

Any idea?

Tnx. I already use 3.2.3-10 :)
[OnePlus 3T ROMs, Kernels, Recoveries, & Other Deve] MSe1969:
If I remember right, if the data partition was formatted with TWRP 3.2.3-1, the encryption footer was gone or so. So if you anyhow did a full wipe before, try formatting the data partition with 3.2.3-10 again.
[OnePlus 3T ROMs, Kernels, Recoveries, & Other Deve] enkidu70:
Ah! That's it! First I did a format data with ext4 then changed to f2fs.

After this, just installing the rom and format did work!

Tnx for your great support!
[OnePlus 3T ROMs, Kernels, Recoveries, & Other Deve] anupritaisno1:
https://android.googlesource.com/pl...refs/heads/master/fs_mgr/fs_mgr_fstab.cpp#240

The proper fix is to add a length=-16384 to the fstab

Example commit:

https://github.com/GlassROM-devices...mmit/8c5212992d365f266a8874e623683ac146fa9845

I removed f2fs but you can keep it if needed

---------- Post added at 01:34 ---------- Previous post was at 01:27 ----------

You actually need to reserve 16384 bytes at the end of the data partition for encryption to start

TWRP had breakages with formatting as F2FS and the maintainer removed the capability
[OnePlus 3T ROMs, Kernels, Recoveries, & Other Deve] enkidu70:
Some more questions:

Is there a way to add face unlock to this rom?

I am having troubles to use GMail and GContacts. I added my Google Account in accounts section without problems. (But it shows sync for all elements is dectivated!? How can I activate it?)

But when I open GMail it asks to connect to a new account. When I again enter the one I already added, it tells me this account is already present!?

Same for GContacts.

What am I doing wrong? (microG self test says all is fine!)

Or what do I have to do to get it working!?

Tnx in advance.
[OnePlus 3T ROMs, Kernels, Recoveries, & Other Deve] MSe1969:
I include microG into my build, I also have experience with it (using it myself), but I am not the ultimate expert of it. For your questions above, I recommended to please look into the respective threads in XDA or into the issues section of the microG GmsCore repo on Github.

In general, I myself don't use Google at all (I use a different mail provider also to sync my contacts, and e.g. for YouTube, there is a very good FOSS app, which is even better than the Google YT app). I use microG because there are many 3rd party apps with embedded Google libs and dependencies, which don't run, if no "Google Play Services" is around. But I don't use any genuine app from Google. Those are much deeper integrated with the original Play Services and often known to have some issues with microG.

Regarding GMail, why not using a different mail app to access your account? GMail also offers to follow the regular email standards (but you have to enable that).

EDIT: I remember (not sure at all) having read somewhere in a thread (maybe even in one of my own threads - sorry, no time right now to search for it) a hint of what to flash to get Face Unlock working on microG.

As I won't include any proprietary Google stuff in my build (even if I wanted to, which is not the case, this could have some legal implications!), this is entirely up to you and I can't support.