[Sony Xperia XA2 ROMs, Kernels, Recoveries, & Other] vince31fr:
iodéOS is not a security focused OS: it is a privacy focused OS. Of course the two aspects are related. What we want to avoid, is to weaken the security of the base OS, that's why we limit modifications, carefully review the one we make, include a very limited set of features from other custom roms, ...

Btw: as a security specialist that I know used to say, the only secure electronic device that exists, is the one that you leave turned off in a safety vault... There are always bugs and security holes even in the most secure code. Fortunately with open source code, vulnerabilities are the most often quickly fixed.

You report here what a developer of GrapheneOS says: is he the more objective to make a comparison between its own OS and Lineage ?... ;)

I see that he makes a lot of criticism about lineage, and it's alway easier to make criticism of an open-source project than good contributions... here is one for his project: does an OS developed by nearly a single guy (look at its github repo), can really be so secure ?... Without perhaps anyone reviewing his code ?

No rollback protection is a feature, not a bug. If you're not happy with the last update, you can switch back to the previous release, which is fine. I don't think that anti-rollback is a feature of AOSP: OEM's are free to implement that, or not, in their AOSP-based roms.

What is much "questionable" in codeaurora, than in any other open source repo ? New vulnerabilities may be included in any merged code, even the most secured one... Codeaurora is fed by Qualcomm, which is after all the most appropriate one to give code for their SOCs, and many people contribute to CAF.

About attack surface, what is mentioned in your source is outdated: ffmpeg is no more included in lineage (look at e.g. this commit). Vulnerabilities are fixed when they are discovered, as in any other code.

About sepolicy in device tree: maybe the devs of that dt based their work on a previous tree, were not happy with the existing sepolicy, and decided to create a new one, which is fine. The vast majority of the sepolicy is included in AOSP+lineage+qualcomm+... repos, only small adaptations are needed for each device. Also, there are safeguards in the common sepolicy: the so-called neverallow rules. Official lineage devices must respect these rules, which is not the case in some other custom roms, which moreover make heavy modifications of the basic AOSP sepolicy. Lineage of course modified the AOSP sepolicy to suit their needs for new features, but many people review the code, before its acceptance in gerrit, and probably after. All commits are reviewed many times. Yes, this can weaken AOSP sepolicy, but as I already said, as soon as you include new code, you include new vulnerabilities. Google does exactly the same with its code: new features, new bugs, new vulnerabilities. If it wasn't the case, why would they monthly publish "security patches" ?...

The advantage of Lineage over all other custom roms is the number of people working on it, improving it, reviewing code, etc. Some of its developers are certainly better than many google devs, and there are many AOSP bugs and vulnerabilities that are fixed in lineage...

Patches are available here (https://github.com/microg/android_packages_apps_GmsCore/tree/master/patches). For Q, the P patch needs to be a bit adapted (some files have been moved elsewhere in the file tree).

Signature spoofing is only granted to system apps which have android.permission.FAKE_PACKAGE_SIGNATURE in their permission file. In iodé: only GmsCore is allowed, of course.

We answered here and here.