[OnePlus 7T Pro (Regular & McLaren) ROMs & Dev.] MSe1969:
This thread is dedicated to provide hardened Lineage-OS 20.0 builds with microG included for the OnePlus 7T Pro (hotdog) with current security patches.

You can consider this thread as the successor of my respective LineageOS 19.1 thread.

Features of this ROM​

Download here

Pre-installed microG like LineageOS for microG project (own fork)

Pre-installed AuroraStore, F-Droid and AuroraServices

OTA Support

Additional security hardening features listed below:

Cloudflare as default DNS (instead of Google)

Privacy-preferred default settings

Optional blocking of Facebook- and Google-Tracking (Settings - Network & Internet)

Optional disable captive portal detection or choose from various providers

Increased max. password length of 64

Enhanced controls for secondary users

Exec spawning (ported from GrapheneOS)

No submission of IMSI/phone number to Google when GPS is in use

Default hosts file with many blocked ad/tracking sites (can be disabled)

Privacy-enhanced Mulch System Webview

Extra control of sensor access for additionally installed user apps (Special access under app permissions)

Kernel kept up to date with ASB patches and other sources (based on DivestOS)

Debloated from Oneplus blobs for Soter and IFAA

Hardened bionic lib and constified JNI method tables

Optional timeout for Bluetooth and WLAN connections

Optional auto-reboot if device not unlocked for defined timeframe

Option to only use fingerprint unlock for apps and not for the device

Per connection WiFi randomization option

Sensitive QS Tiles require unlocking

Native debugging

Ability to disable non-system apps from the "App info" screen

Scoped storage (ported from GrapheneOS)

Scoped Contacts (ported from GrapheneOS)

Firewall UI (Settings - Network & Internet - Manage data restrictions)

Dialer patches from CalyxOS offering Signal or WA calls from the Dialer, if available

Slightly hardened GPS configuration

Current release levels​

Security string: 2024-07-05

AOSP tag: 13.0.0_r67

Mulch System Webview: M126

Source-code and build instructions​

Kernel: https://github.com/lin20-microG/android_kernel_oneplus_sm8150/tree/lin-20.0-mse

Build manifest: https://github.com/lin20-microG/local_manifests/tree/lin-20.0-microG

Installation Instructions​

YOU ARE RESPONSIBLE SOLELY YOURSELF FOR ANY ACTIONS YOU DO WITH YOUR DEVICE !!!

Please note - I won't explain any single aspect (e.g. how to install 'fastboot' on your PC or troubleshoot USB connectivity issues under Windows). Search the net and consult the search engine of your choice or look here in XDA, there is plenty of information available.

Pre-Requisites​

Have fastboot and adb installed on your PC and make sure, you can connect via USB to your device in fastboot mode and via adb

An unlocked bootloader (see e.g. LineageOS install instructions)

If you come from Stock ROM, make sure to upgrade your device to the latest offered software version

Know, how to boot into fastboot mode (with powered off device press [Power]+[Vol.down]+[Vol.up])

Please read carefully:

I refer in general to the LineageOS install instructions, but there are some deviations!

It is recommended to really carefully go completely through the LineageOS instructions and my instructions given below once, before doing anything. You have been warned!

Let's go!​

Download the recovery for this build.

For the Oneplus 7T Pro (hotdog), there is currently no fully working official TWRP available! The offered official one can't decrypt the /data partition and I am not 100% sure about the rest (it is currently not actively maintained, either).

Please download and unpack the specific Lineage revocery for this build. It has been built using this ROM's signing key.

If you come from Stock ROM or any other ROM than my previous 19.1 build, please follow the instructions 1:1 as explained in the LineageOS installation instructions, just with two exceptions/clarifications:

A. You use the downloaded above mentioned recovery and you flash it with the further below mentioned two commands.

B. Please read the firmware clarification

If you use already my LineageOS 19.1 build, simply proceed as described below:

Reboot to bootloader (fastboot mode) and flash the recovery as follows:

fastboot flash recovery_a lineage-20.0-20230804-recovery-hotdog.img
fastboot flash recovery_b lineage-20.0-20230804-recovery-hotdog.img

The firmware should be F22; whilst any Android 12 based firmware should work, I really recommend to be on F22.

A good place to obtain the firmware is here, other methods are described the LineageOS firmware update instructions.

Reboot now into recovery from fastboot (follow the menu options) - DO NOT boot into your OS yet.

Install the ROM​

If you come from my previous LineageOS 19.1 ROM, you can simply sideload the 20.0 ROM on top of my 19.1 ROM, so don't format the /data partition (unless you really want to get rid of your data). In all other cases, you have no choice than formatting /data, so continue as described in the LineageOS installation instructions with formatting /data and sideloading the ROM ZIP (download link above).

It is normal, that you may observe at 47% progress a longer break, followed by a step 1/2 and finally 2/2 before a success message appears.

In case you need (or want) to format /data: Please keep in mind, that formatting the /data partition also wipes the shared internal memory - backup first!

DO NOT flash Gapps!

This ROM comes with pre-installed microG. So don't attempt to flash Gapps. If Gapps is a 'must' for you, please use the official LineageOS build for this device.

Update Instructions​

This ROM offers OTA updates through the Updater app. Therefore, normally, no further activities necessary.

You can however also manually update the ROM by side loading a newer version of this ROM via recovery.

Frequently asked questions​

These questions come from various threads for my hardened microG ROMs. I have listed them here, because they also apply to this ROM and are hopefully helpful.

1. AuroraStore

I bundle AuroraStore with my build, but I am in no way associated with its development. The first place to look for support is the AuroraStore XDA thread and its excellent FAQ Section. Nevertheless, I would like to answer some frequently asked questions in conjunction to my ROM:

Q: AuroraStore offers an update to "Google play services" - I thought your ROM is "Google-free"?

A: The bundled microG application spoofs the existence of Google play services. This is a necessary part of microG's design. In AuroraStore, please add the Play Services to the ignore list. You won't be able to "update" them anyhow, but better do not even try to do so!

Q: I can't connect, Aurora claims "no network" - but I can normally use my browser and other apps to connect to the internet.

A: If the "iptables block script" of my ROM is active, try to deactivating and immediately after re-activating it. If that does not help or you don't use the iptables block script of tis ROM, you may try to force-close the app or logoff/logon again. However, the Aurora support thread will be your primary point to look at!

2. Google/Facebook iptables blocking

Q: How does the Google/Facebook blocking work?

A: Via the 'iptables'/'ip6tables' functionality of the Linux layer of Android, the ip4/ip6 address range of Google and Facebook is blocked on a per app base (in fact, it is generally blocked, but some apps on an internal exception list are still allowed to connect). This means, that apps (or spyware components thereof) cannot send/receive data to/from Google/Facebook. Btw, certain connections to X-mode and Palantir are also blocked, but I am not sure, whether this is enough - any qualified information to improve this are very welcome!

Q: I like this Google/Facebook blocking approach, but my favourite <xyz> app needs to be able to connect to Google/Facebook. Can you please add this app to your exception list?

A: Please read this comprehensive information. In short: If you have a trustworthy FOSS project aiming at connecting to Google/Facebook via Webview as 'mobile browser' with (almost) no permissions or you have a tracker-free app to connect to a proprietary service, which simply is hosted on a Google webspace, I am happy to discuss this, but I will definitely not allow any "Playstore top ten genuine spyware app".

Q: Which apps are on your exception list?

A: see here

Q: But if Google is blocked for almost every app, can I still get push messages?

A: Yes, you can! Push messages are routed and controlled through the microG functionality, which stil can connect to Google.

3. etc/hosts ad blocking

Q: What is the etc/hosts ad-blocking and how does it work?

A: I deliver a monthly-updated /system/etc/hosts file from the AdAway app which lists a comprehensive selection of known ad/spyware addresses. Any attempt to connect to those sites is redirected to the local OS, so a positive connection is reported, but no content is transmitted. (See linked explanation).

Q: Which anti-tracker lists do you use?

A: The same defaulted by the AdAway app, plus in addition Microsoft's 'Hockey Stick' stuff.

4. Firewall UI

Q: What is the Firewall UI and how does it work?

A: Under Settings - Privacy - Manage data restrictions, you'll find a list of all installed apps (optionally, you can also show the shipped system apps), which lets you control - per app - whether the app can connect via WiFi, Mobile data or VPN. In fact, you can in any LineageOS individually control this in the app details (Settings), this option simply gives you a comprehensive view for all apps.

Q: How do I use it? What are the typical use-cases:

A: It of course depends on your specific requirement, but below some very typical use-cases:

a. Disallow internet access completely (uncheck WiFi, mobile data and VPN) - This might be useful for an app, which does not need internet access to work, but uses internet access to e.g. nag you with ad-crap (some games on the play store, for example)

b. Make sure, that an app only uses WiFi (in order to avoid costs when using mobile data) - uncheck mobile data

c. Make sure, that an app only has internet, when connected via VPN - uncheck WiFi and mobile data

5. Privacy features / data privacy of this ROM

Q: Does this ROM protect my privacy by design/default?

A: First of all, you will never get any "auto-protection" without having to take care, what you do!

What this ROM provides to you in addition to an "official" LineageOS:

This ROM comes with microG, to avoid the necessity of having to flash the Google apps, with the "mother of all spyware" called Google Play services. So many apps with that dependency would still work, either fully, or with their core-functionality, but without "extra Google convenience" features.

You can optionally block Google/Facbebook connections, which can add a further protecion layer (see the specific FAQ section about that feature)

Many nasty ad-servers, which are embedded into shady apps or websites are blocked by default

Some hardening measures known from the GrapheneOS project have been added

HOWEVER - just some examples, how you can easily screw up any privacy gain (this list is by far not even near to comprehensive):

You still CAN install all kinds of shady apps and use privacy-ignoring services. If you e.g. install the genuine Facebook or Instagram app, the majority of your private data on your phone will be immediately uploaded to Facebook servers, as those apps even refuse to start, if you do not grant all the sensitive permissions! (Note: Yes, afterwards, when your data has already been stolen, you can revoke those permissions again. And yes, Whatsapp seems maybe 'slightly' better in this regard, but if you really believe, that WA isn't fully integrated into the FB ecosystem, you must be living on another planet).

If you use the Microsoft Outlook app to connect to any "non-Microsoft" e-mail provider, your logon credentials to that other mail provider are stored on Microsoft servers factually allowing Microsoft to steal your identity. Using Microsoft e-mail services or GMail discloses all your e-mails to automated scanning for "suspicious activities"; this has nothing to do with your phone, but outlines, how you can void even the most secure device by making use of privacy-ignoring services.

Making use of Genuine Google-apps with microG also isn't a good idea - make use of alternatives.

Any app, which you install on your device, could misuse its needed privileges! So try to stick to FOSS apps.

And last, but not least, if you are a 'dissident' or fear otherwise any targeted or comprehensive surveillance, this ROM isn't for you either...

Dealing with signed builds​

Please note, that this builds is signed with an own key. When you come from a different build, you cannot directly "dirty-flash" this build. You have to perform a "clean flash".

Bug reports:​

If you have a problem, please create a post with these informations:

Original Kernel shipped with this rom:

Build Date:

And try to get log as described here

Please note that I can't and won't support issues with builds using a different kernel or Xposed.

In regards to microG, I will try my best to help when it is related to this ROM (I use it myself), but any questions of the type "the YXZ-app can't do <some sort of fancy xyz Google functionality> properly" are better asked in the respective microG forums.

Further, besides to some generic advice, I do not consider it my obligation to ensure proper Magisk support (it should work, but I haven't tested it and I won't flash it on my device to track down reported issues).

Credits​

AOSP project

LineageOS project

microG project

Graphene OS project (many privacy and security features have been ported)

WhyOrean (Aurora)

SkewedZeppelin (Kernel patches and some good ideas of Divest-OS)