These are the old changelogs for production releases of GrapheneOS. See the current releases changelog for more recent releases.
The release notes before the Nougat 2016.12.06.05.21.23 release should be taken with a grain of salt since we weren't really publishing them yet so it wasn't being done very carefully.
GrapheneOS started in 2014 based on Android KitKat but we only started keeping more user friendly changelogs late in the Marshmallow era.
The Nexus 9 maintenance branch is not included. It split off when the other devices moved to nougat-mr2-release and continued after the other devices moved to Oreo-based releases. It may be included here in the future but we wanted to avoid confusion.
Since Pixels, there are separate release channels including the public Stable and Beta channels. Each Stable release made it through the Beta channel and our internal Testing channel. The Nexus 5X and 6P moved to the current update system with release channels with the Oreo-based 2017.09.24.15.
Experimental releases are not listed here.
Changes since 2018.05.15.17:
- 2018-06-01 security patch level including recommended updates
- 2018-06-05 security patch level including recommended updates
- 2018-06 Pixel/Nexus functional updates
- Pixel 2, Pixel 2 XL: increase rollback index for 2018-06-05 patch level
- Pixel, Pixel XL: kernel: cherry-pick stable kernel commits from 3.18.108 to 3.18.109
- Pixel, Pixel XL: kernel: cherry-pick stable kernel commits from 3.18.109 to 3.18.110
- Pixel, Pixel XL: kernel: cherry-pick stable kernel commits from 3.18.110 to 3.18.111
- Pixel, Pixel XL: kernel: cherry-pick stable kernel commits from 3.18.111 to 3.18.112
- Pixel 2, Pixel 2 XL: kernel: cherry-pick stable kernel commits from 4.4.131 to 4.4.132
- Pixel 2, Pixel 2 XL: kernel: cherry-pick stable kernel commits from 4.4.132 to 4.4.133
- Pixel 2, Pixel 2 XL: kernel: cherry-pick stable kernel commits from 4.4.133 to 4.4.134
- Pixel 2, Pixel 2 XL: kernel: cherry-pick stable kernel commits from 4.4.134 to 4.4.135
- Chromium: update from 66.0.3359.158 to 67.0.3396.68
Changes since 2018.05.08.01:
- Chromium: update from 66.0.3359.126 to 66.0.3359.158
- add back Nexus 6P support now that the kernel tag is available
Changes since 2018.04.19.04:
- 2018-05-01 security patch level including recommended updates
- 2018-05-05 security patch level including recommended updates
- 2018-05 Pixel/Nexus functional updates
- Pixel 2, Pixel 2 XL: increase rollback index for 2018-05-05 patch level
- Chromium: prevent popular sites field trial from overriding changed default
- Chromium: prevent non-secure origin field trial from overriding changed default
- Chromium: update from 66.0.3359.106 to 66.0.3359.126
- Pixel, Pixel XL: kernel: cherry-pick stable kernel commits from 3.18.105 to 3.18.106
- Pixel, Pixel XL: kernel: cherry-pick stable kernel commits from 3.18.106 to 3.18.107
- Pixel, Pixel XL: kernel: cherry-pick stable kernel commits from 3.18.107 to 3.18.108
- Pixel 2, Pixel 2 XL: kernel: cherry-pick stable kernel commits from 4.4.128 to 4.4.129
- Pixel 2, Pixel 2 XL: kernel: cherry-pick stable kernel commits from 4.4.129 to 4.4.130
- Pixel 2, Pixel 2 XL: kernel: cherry-pick stable kernel commits from 4.4.130 to 4.4.131
- Silence: update from 0.15.12 to 0.15.13
- Net Monitor: update from 1.2 to 2.0
- F-Droid: update from 1.1 to 1.2 (held back earlier due to bugs)
- F-Droid: update from 1.2 to 1.2.1 (held back earlier due to bugs)
- F-Droid: update from 1.2.1 to 1.2.2
Changes since 2018.04.02.21:
- Settings: expose audio recording user restriction
- Settings: expose install apps user restriction
- Pixel, Pixel XL: kernel: cherry-pick stable kernel commits from 3.18.102 to 3.18.103
- Pixel, Pixel XL: kernel: cherry-pick stable kernel commits from 3.18.103 to 3.18.104
- Pixel, Pixel XL: kernel: cherry-pick stable kernel commits from 3.18.104 to 3.18.105
- Pixel 2, Pixel 2 XL: kernel: cherry-pick stable kernel commits from 4.4.126 to 4.4.127
- Pixel 2, Pixel 2 XL: kernel: cherry-pick stable kernel commits from 4.4.127 to 4.4.128
- Nexus 5X, Nexus 6P: fix ro.control_privapp_permissions=enforce setup (works fine on Pixels already)
- use Cloudflare DNS as the default fallback: Cloudflare DNS has a better privacy policy than Google Public DNS and has DNS-over-TLS and DNS-over-HTTPS so it won't be a downgrade when Android ships one of them
- tethering: use Cloudflare DNS servers as the default fallbacks
- NetworkDiagnostics: switch to Cloudflare DNS
- SettingsLib: use Cloudflare DNS servers as hints
- Chromium: update from 65.0.3325.109 to 66.0.3359.106
Changes since 2018.03.27.11:
- 2018-04-01 security patch level including recommended updates
- 2018-04-05 security patch level including recommended updates
- 2018-04 Pixel/Nexus functional updates
- Pixel 2, Pixel 2 XL: increase rollback index for 2018-04-05 patch level
- Pixel 2, Pixel 2 XL: kernel: cherry-pick stable kernel commits from 4.4.124 to 4.4.125
- Pixel 2, Pixel 2 XL: kernel: cherry-pick stable kernel commits from 4.4.125 to 4.4.126
Changes since 2018.03.13.20:
- include TalkBack and Switch Access accessibility services since they're now open source
- switch dummy values for ro.build.user/ro.build.host from user/host to the OS name
- Pixel 2, Pixel 2 XL: kernel: cherry-pick stable kernel commits from 4.4.121 to 4.4.122
- Pixel 2, Pixel 2 XL: kernel: cherry-pick stable kernel commits from 4.4.122 to 4.4.123
- Pixel 2, Pixel 2 XL: kernel: cherry-pick stable kernel commits from 4.4.123 to 4.4.124
- Pixel, Pixel XL: kernel: cherry-pick stable kernel commits from 3.18.99 to 3.18.100
- Pixel, Pixel XL: kernel: cherry-pick stable kernel commits from 3.18.100 to 3.18.101
- Pixel, Pixel XL: kernel: cherry-pick stable kernel commits from 3.18.101 to 3.18.102
- PDF Viewer: make prerendering work again after refactoring
- PDF Viewer: fix prerendering previous page
- PDF Viewer: switch from getTextContent to streamTextContent
- PDF Viewer: move maybeRenderNextPage check earlier
- PDF Viewer: use a single task variable
- PDF Viewer: overhaul document properties and parsing (from @Tommy-Geenexus)
- PDF Viewer: switch to Java 8
- PDF Viewer: improve error logging
- PDF Viewer: update version to 3
- F-Droid: update to 1.1
Changes since 2018.03.10.15:
- Pixel 2, Pixel 2 XL: kernel: cherry-pick stable kernel commits from 4.4.120 to 4.4.121
- Pixel, Pixel XL: kernel: cherry-pick stable kernel commits from 3.18.98 to 3.18.99
- PDF Viewer: use CSS scaling while waiting for zoomed rendering
- PDF Viewer: implement Least Recently Used (LRU) rendering cache
- PDF Viewer: prerender the next page
- PDF Viewer: use an opaque canvas for performance
- PDF Viewer: add basic render logging
- PDF Viewer: add error logging for promises
- PDF Viewer: only use offscreen rendering
- PDF Viewer: prerender the previous page too
- PDF Viewer: reset scroll position for new pages
- Pixel 2 only (not Pixel 2 XL): include the right default APN database
- Chromium: disable showing popular sites by default
- Chromium: disable article suggestions feature by default (not supported by us and wastes UI space)
- Chromium: fix the default value displayed for the hyperlink auditing flag
- Chromium: update to 65.0.3325.109
- Updater: add support for testing streaming updates (not in a useful way yet)
- SELinux policy: fix overly noisy app_data_file execute auditallow for third party apps (untrusted_app rather than untrusted_base_app) where it's still permitted
- Pixel 2 XL: kernel: fix upstream bug in lge_battery module breaking fast charging with a monolithic kernel build (found by @nathanchance)
- Launcher3: stop disabling icon normalization
- Launcher3: stop wrapping legacy icons into adaptive icons
- base frameworks: use round adaptive icon mask and parse round icons
Changes since 2018.03.01.14:
- 2018-03-01 security patch level including recommended updates
- 2018-03-05 security patch level including recommended updates
- 2018-03 Pixel/Nexus functional updates
- Pixel 2, Pixel 2 XL: increase rollback index to 3 for 2018-03-05 patch level
- Settings: update_engine downgrade attack we reported is now fixed upstream, remove from extra security patches field
- Pixel 2, Pixel 2 XL: kernel: cherry-pick stable kernel commits from 4.4.119 to 4.4.120
- Pixel, Pixel XL: kernel: cherry-pick stable kernel commits from 3.18.97 to 3.18.98
- Pixel 2, Pixel 2 XL: kernel: enable KPTI (already enabled for the Pixel and Pixel XL in AOSP, Google disabled it for the Pixel 2 and Pixel 2 XL since it's not crucial on the Snapdragon 835 but it's still useful hardening and fixes a known way to leak system registers)
Changes since 2018.02.18.00:
- Pixel, Pixel XL, Pixel 2, Pixel 2 XL: drop unused google_camera_app SELinux domain: Google Camera isn't available in a useful way so exposing the Hexagon DSP tech stack as attack surface via Google Camera is unnecessary. HDR+ is provided via the Pixel Visual Core to compatible apps already on the Pixel 2 and Pixel 2 XL.
- Pixel 2, Pixel 2 XL: kernel: cherry-pick stable kernel commits from 4.4.116 to 4.4.117
- Pixel 2, Pixel 2 XL: kernel: cherry-pick stable kernel commits from 4.4.117 to 4.4.118
- Pixel 2, Pixel 2 XL: kernel: cherry-pick stable kernel commits from 4.4.118 to 4.4.119
- Pixel 2, Pixel 2 XL: kernel: backport "staging: android: ashmem: Fix possible deadlock in ashmem_ioctl" fix for "staging: android: ashmem: Fix a race condition in pin ioctls" commit in 4.4.118
- Pixel, Pixel XL: kernel: cherry-pick stable kernel commits from 3.18.95 to 3.18.96
- Pixel, Pixel XL: kernel: cherry-pick stable kernel commits from 3.18.96 to 3.18.97
- include Stk package for all devices, not just the Pixel and Pixel XL
- Pixel 2, Pixel 2 XL: kernel: disable unnecessary ramdisk compression support (bzip2, lzma)
- Pixel 2, Pixel 2 XL: kernel: disable FTRACE support in production builds
- F-Droid: update to 1.0.3
- Silence: update to 0.15.12
Changes since 2018.02.05.23:
- Pixel, Pixel XL, Pixel 2, Pixel 2 XL: kernel: fix uninitialized scatterlist in qce detected by DEBUG_SG
- Pixel, Pixel XL, Pixel 2, Pixel 2 XL: kernel: enable DEBUG_SG
- Pixel, Pixel XL: kernel: reduce one DEBUG_SG check to a warning for now
- Pixel, Pixel XL: kernel: cherry-pick stable kernel commits from 3.18.93 to 3.18.94
- Pixel, Pixel XL: kernel: cherry-pick stable kernel commits from 3.18.94 to 3.18.95
- Pixel 2, Pixel 2 XL: kernel: cherry-pick stable kernel commits from 4.4.115 to 4.4.116
- Pixel 2, Pixel 2 XL: kernel: Revert "ANDROID: Revert "arm64: move ELF_ET_DYN_BASE to 4GB / 4MB"" (spotted by @nathanchance)
- lower pid_max to 1/4 of the default to guarantee a 4x higher max_map_count is theoretically safe despite the kernel being broken (not enough memory on real devices to matter but still)
- Pixel 2, Pixel 2 XL: android-prepare-vendor: fix vendor.img AB_OTA_PARTITIONS inclusion
- Settings: sort applications in sensors and clipboard background permission toggle lists (@rascarlo noticed the sorting code in the location/audio lists was missing for these)
- Updater: add generated icons
- Updater: bump version
- PDF Viewer: replace launcher icon
- PDF Viewer: bump version
- Camera app: properly handle INFO_SUPPORTED_HARDWARE_LEVEL_3 (enables support for Zero-Shutter-Lag on the Nexus 5X, Nexus 6P, Pixel, Pixel XL, Pixel 2 and Pixel 2 XL)
Changes since 2018.01.26.22:
- 2018-02-01 security patch level including recommended updates
- 2018-02-05 security patch level including recommended updates
- 2018-02 Pixel/Nexus functional updates
- Pixel 2, Pixel 2 XL: increase rollback index to 2 for 2018-02-05 patch level
- Silence: update to v0.15.11
- Pixel 2, Pixel 2 XL: kernel: cherry-pick stable kernel changes up to 4.4.115
- Pixel, Pixel XL: kernel: cherry-pick stable kernel changes up to 3.18.93
- Nexus 5X, Nexus 6P, Pixel, Pixel XL, Pixel 2, Pixel 2 XL: kernel: switch user / host for reproducible builds from 'user' and 'host' to OS name
- Pixel, Pixel XL: kernel: use a more targeted workaround for bogus GCC warning
- improvements to repository management scripting
- Chromium: icon recolor
- Chromium: update to 64.0.3282.123 from 64.0.3282.116
- Chromium: update to 64.0.3282.137 from 64.0.3282.123
Changes since 2018.01.25.17:
- move isAppForeground check outside of the AppOpsService lock scope to avoid occasional deadlocks between ActivityService and AppOpsService
Changes since 2018.01.23.20:
- Chromium: update to 64.0.3282.116
- remove separate WebView again
- add per-app setting to disallow background location access
- add per-app setting to disallow background sensors access
- Pixel 2, Pixel 2 XL: increase rollback index
Changes since 2018.01.03.02:
- android-prepare-vendor changes for Pixel 2 and Pixel 2 XL support
- add Alpha quality Pixel 2 and Pixel 2 XL support
- add AVB (Android Verified Boot 2.0) support to the release signing script for taimen and walleye
- Pixel 2, Pixel 2 XL: use custom boot logo
- Pixel 2, Pixel 2 XL: use SHA256_RSA2048 as the AVB algorithm for test keys to match production
- Pixel 2, Pixel 2 XL: use sane value for PRODUCT_MODEL
- Pixel 2, Pixel 2 XL: add Updater app
- Pixel 2, Pixel 2 XL: remove messaging app
- Pixel 2, Pixel 2 XL: disable the system_other odex split
- Pixel 2, Pixel 2 XL: add release signing script support
- Pixel 2, Pixel 2 XL: update for proc_net split
- Pixel 2, Pixel 2 XL: update for isolated_app split
- Pixel 2, Pixel 2 XL: fix enabled_networks_values / enabled_networks_except_gsm_values
- Pixel 2, Pixel 2 XL: adjust for LTE only addition
- Pixel 2, Pixel 2 XL: switch to in-tree kernel builds
- Pixel 2, Pixel 2 XL: make kernel builds reproducible
- Pixel 2, Pixel 2 XL: split wahoo kernel configuration
- Pixel 2, Pixel 2 XL: build in device-specific kernel modules instead of loading them from vendor.img
- Pixel 2, Pixel 2 XL: strip out infrastructure for modular kernel builds
- Pixel 2, Pixel 2 XL: switch to clang-compiled kernels
- Pixel 2, Pixel 2 XL: kernel: enable the custom Clang -fsanitize=local-init feature
- Pixel 2, Pixel 2 XL: split debug and production kernel configuration
- Pixel 2, Pixel 2 XL: kernel: disable SECURITY_SELINUX_DEVELOP for user builds
- Pixel 2, Pixel 2 XL: kernel: enable SLUB_DEBUG_ON for debug kernels
- Pixel 2, Pixel 2 XL: kernel: replace SECURITY_SMACK with SECURITY_NETWORK
- Pixel 2, Pixel 2 XL: kernel: enable SECURITY_YAMA
- Pixel 2, Pixel 2 XL: kernel: disable ptrace_scope by default
- Pixel 2, Pixel 2 XL: kernel: enable protected_{symlinks,hardlinks} by default
- Pixel 2, Pixel 2 XL: kernel: disable AIO
- Pixel 2, Pixel 2 XL: kernel: enable DEBUG_LIST
- Pixel 2, Pixel 2 XL: kernel: enable DEBUG_CREDENTIALS
- Pixel 2, Pixel 2 XL: kernel: remove module build support
- Pixel 2, Pixel 2 XL: kernel: wcnss: fix 3 byte buffer overflow on MAC change
- Pixel 2, Pixel 2 XL: kernel: disable brk system call
- Pixel 2, Pixel 2 XL: kernel: backport "init/main.c: extract early boot entropy from the passed cmdline" which was upstreamed by us
- Pixel 2, Pixel 2 XL: kernel: gather extra early boot entropy
- Pixel 2, Pixel 2 XL: kernel: backport "mm/slab.c: fix SLAB freelist randomization duplicate entries" to fix Google's disabled FREELIST_RANDOM backport
- Pixel 2, Pixel 2 XL: kernel: backport "mm/slub.c: fix random_seq offset destruction" to fix Google's disabled FREELIST_RANDOM backport
- Pixel 2, Pixel 2 XL: kernel: enable SLAB_FREELIST_RANDOM
- Pixel 2, Pixel 2 XL: kernel: backport "mm/slub: query dynamic DEBUG_PAGEALLOC setting" to make other changes apply cleanly
- Pixel 2, Pixel 2 XL: kernel: backport "mm: add SLUB free list pointer obfuscation" including the per-slab randomization upstreamed by us
- Pixel 2, Pixel 2 XL: kernel: backport "mm/slub.c: add a naive detection of double free or corruption"
- Pixel 2, Pixel 2 XL: kernel: enable SLAB_FREELIST_HARDENED
- Pixel 2, Pixel 2 XL: kernel: backport "mm: allow slab_nomerge to be set at build time"
- Pixel 2, Pixel 2 XL: kernel: disable SLAB_MERGE_DEFAULT
- Pixel 2, Pixel 2 XL: kernel: add a SLAB_HARDENED configuration option
- Pixel 2, Pixel 2 XL: kernel: add missing cache_from_obj !PageSlab check
- Pixel 2, Pixel 2 XL: kernel: real slab_equal_or_root check for !MEMCG_KMEM
- Pixel 2, Pixel 2 XL: kernel: bug on kmem_cache_free with the wrong cache
- Pixel 2, Pixel 2 XL: kernel: always perform cache_from_obj consistency checks
- Pixel 2, Pixel 2 XL: kernel: bug on !PageSlab && !PageCompound in ksize
- Pixel 2, Pixel 2 XL: kernel: backport "mm/mmap.c: mark protection_map as __ro_after_init"
- Pixel 2, Pixel 2 XL: kernel: backport "mark most percpu globals as __ro_after_init" including the extensions by us
- Pixel 2, Pixel 2 XL: kernel: randomize lower bits of the argument block
- Pixel 2, Pixel 2 XL: kernel: restrict device side channels
- Pixel 2, Pixel 2 XL: kernel: add toggle for disabling newly added USB devices
- Pixel 2, Pixel 2 XL: kernel: backport "arm64: vdso: add __init section marker to alloc_vectors_page"
- Pixel 2, Pixel 2 XL: kernel: backport "arm64: vdso: constify vm_special_mapping used for aarch32 vectors page"
- Pixel 2, Pixel 2 XL: kernel: backport "arm64: apply __ro_after_init to some objects"
- Pixel 2, Pixel 2 XL: kernel: backport "arm64, vdso: Define vdso_{start,end} as array"
- Pixel 2, Pixel 2 XL: kernel: add kmalloc/krealloc alloc_size attributes
- Pixel 2, Pixel 2 XL: kernel: add vmalloc alloc_size attributes
- Pixel 2, Pixel 2 XL: kernel: add percpu alloc_size attributes
- Pixel 2, Pixel 2 XL: kernel: add alloc_pages_exact alloc_size attributes
- Pixel 2, Pixel 2 XL: kernel: backport "include/linux/string.h: add the option of fortified string.h functions" which was upstreamed by us
- Pixel 2, Pixel 2 XL: kernel: backport "replace incorrect strscpy use in FORTIFY_SOURCE" which was upstreamed by us
- Pixel 2, Pixel 2 XL: kernel: enable FORTIFY_SOURCE
- Pixel 2, Pixel 2 XL: kernel: backport "random,stackprotect: introduce get_random_canary function"
- Pixel 2, Pixel 2 XL: kernel: backport "arm64: ascii armor the arm64 boot init stack canary" which was upstreamed by us
- Pixel 2, Pixel 2 XL: kernel: add simpler page sanitization
- Pixel 2, Pixel 2 XL: kernel: add support for verifying page sanitization
- Pixel 2, Pixel 2 XL: kernel: slub: add basic full slab sanitization
- Pixel 2, Pixel 2 XL: kernel: slub: add support for verifying slab sanitization
- Pixel 2, Pixel 2 XL: kernel: slub: add multi-purpose random canaries
- Pixel 2, Pixel 2 XL: kernel: backport "arm64/mmap: properly account for stack randomization in mmap_base" which was upstreamed by us
- Pixel 2, Pixel 2 XL: kernel: arm64: determine stack entropy based on mmap entropy
- Pixel 2, Pixel 2 XL: kernel: Revert "Revert "arm: move ELF_ET_DYN_BASE to 4MB""
- Pixel 2, Pixel 2 XL: kernel: Revert "mm: revert x86_64 and arm64 ELF_ET_DYN_BASE base changes"
- Pixel 2, Pixel 2 XL: kernel: add specialized associated MAC randomization for qcacld-3.0
- Pixel, Pixel XL: kernel: simplify specialized associated MAC randomization for qcacld-2.0 to match taimen/walleye implementation
- set clang vendor string to indicate -fsanitize=local-init and future extensions are present
- simplify clang build environment
- rebuild clang prebuilt
- system/core/libutils/RefBase.cpp: fix build with debugging
- F-Droid privileged extension: whitelist taimen / walleye releasekeys
- move pthread_internal_t out of the stack mapping again
- Nexus 5X, Nexus 6P, Pixel, Pixel XL, Pixel 2 (everything but the Pixel 2 XL): replace default wallpaper
- Pixel, Pixel XL, Pixel 2, Pixel 2 XL: kernel: disable module support in production builds
- VTS: drop requirement to support kernel modules
- malloc: drop workaround for use-after-free in init now that it's fixed upstream
Changes since 2017.12.17.21:
- 2018-01-01 security patch level
- 2018-01-05 security patch level
- PackageInstaller: add back fix for upstream bug preventing toggling off current permissions in review
- disable exec spawning for apps that are being debugged until the debug features are compatible (upstream bug)
- improve robustness of the code implementing toggles for background audio recording and clipboard access
- Updater: bump API level to 27
- PDF Viewer: bump API level to 27
- F-Droid: update to 1.0.2
Changes since 2017.12.12.16:
- Silence: update to 0.15.10
- Chromium: update to 63.0.3239.111
- Google WebView (included until Android 8.1 WebView stable release is open source): update to 63.0.3239.111
- Pixel, Pixel XL: remove AOSP Updater package inclusion
Changes since 2017.12.10.21:
- set the default for the background audio recording toggle to allowed for the time being
Blocking background audio recording by default ended up hitting far more app compatibility issues than expected. The goal is still to disable it by default but we need to whitelist Phone services and figure out if anything can be done to improve compatibility with apps like Signal and WhatsApp.
Changes since 2017.12.07.19:
- Updater: reduce update check rate to every 4 hours from 1
- Updater: reduce retry rate to every 4 minutes from 1
- DeskClock: fix broken upstream fix in Android 8.1 to match our fix for Android 8.0
- Nexus 5X: update stock update-binary to OPM1.171019.011
- stop disabling brotli compression for legacy format over-the-air updates
- replace global toggle for background clipboard access with a per-app toggle (still disabled by default)
- add toggle for background audio recording (now disabled by default)
Apps can still start recording audio in the foreground and continue in the background even with background audio recording disabled. This will end up being mitigated in the future but it isn't fully implemented yet.
Changes since the 2017.12.06.06 release:
- SELinux policy: allow system_app to read selinuxfs for the Settings SELinux status display
- Chromium: update to 63.0.3239.83 from 62.0.3202.84
- update android-prepare-vendor to the latest revision
- add back Nexus 5X and Nexus 6P support
- replace obsolete brotli command line syntax
- disable OTA update brotli compression since it breaks on the 5X and is only for legacy pre-Pixel devices anyway
Changes since the 2017.11.20.01 release:
- 2017-12-01 security patch level
- 2017-12-05 security patch level
- update android-prepare-vendor to the latest revision
- migrate from Android 8.0 to Android 8.1 (MR1)
- Settings: stop marking KRACK fixes as extra security patches since Google included the fixes in AOSP
- kernel (Pixel, Pixel XL): add fixes for GCC builds until time is available to migrate to using Clang like Google
- Launcher3: revert broken upstream commit
- overhaul exec spawning to work with the new spawning infrastructure
- overhaul SELinux policy changes to cope with Treble ABI compatibility layer
- temporarily switch to official WebView build (63.0.3239.83) due to temporary lack of published Chromium sources with API 27 WebView support
- set up the slightly hardened Clang / LLVM toolchain for mr1
Known upstream issues for Android 8.1:
- Settings app wrongly displays the SELinux status as Permissive because SELinux prevents Settings from reading the SELinux enforce mode
- Pixel verified boot fingerprint display has been fixed but the fingerprint is not yet meaningful (verified boot does continue to work and automatically enforces that the key doesn't change, it's only a fingerprint display issue)
- android-prepare-vendor may not work properly without manual intervention
- script: include directory for python2 workaround
- limit platform signature permissions to system again
- dr1 only: rebuild clang with our patch adding support for the local-init sanitizer and enable it again in build/make and build/soong
- update android-prepare-vendor to latest upstream revision
- PDF Viewer: minor UX improvements (from @Tommy-Geenexus)
- Updater: add warning about illegitimate resellers for legacy devices (Nexus 5X, Nexus 6P)
- 2017-11-01 security patch level
- 2017-11-05 security patch level
- other November 2017 security update changes for Nexus/Pixel devices from AOSP
- Chromium (including the WebView): update to 62.0.3202.84 from 62.0.3202.73
- F-Droid: update base code to 1.0.1
- PDF Viewer: update pdf.js to 1.9.426 including fixing a conflict with our change to allow sane style-src Content Security Policy
- SELinux policy: disallow execmem for ephemeral_app
- SELinux policy: auditallow execmem for untrusted app domains again
- SELinux policy: auditallow app_data_file execute for untrusted app domains again
- SELinux policy: restore missing dalvikcache_data_file execute rules for non-base-system apps
- sdcard service: enable the object-size sanitizer again (our integer sanitizer change is now upstream)
- Chromium (including the WebView): update to 62.0.3202.73 from 62.0.3202.66
- Settings: mark anti-theft protection as not available if file-based encryption isn't supported to avoid confusion
- replace decentralized python2 workarounds with a global workaround in our envsetup wrapper
- HiKey: remove broken bootloader requirement for now (the bootloader isn't passing a version on the kernel command line)
- svox: drop fix for CTS failure and use the upstream fix from oreo-dr1-release
- assorted tweaks to minimize conflicts when cherry-picking from oreo-r3-release to oreo-dr1-release
- add oreo-dr1-release branch
- dr1 only: manually port changes with conflicts from oreo-r3-release: platform_bionic, platform_bootable_recovery, platform_build, platform_build_soong, platform_external_svox, platform_external_sqlite, platform_frameworks_base, platform_packages_apps_Bluetooth, platform_packages_apps_Settings, platform_prebuilts_clang_host_linux-x86, platform_system_sepolicy
- dr1 only: add HiKey 960 support
- dr1 only: backport upstream fix for bad merge in services/surfaceflinger/DisplayHardware/FramebufferSurface.cpp
- dr1 only: backport upstream fix for hwc1 support for HiKey / HiKey 960
- dr1 only: apply SettingsProvider fix from r3 that was missing to keep the settings db version in sync
- dr1 only: backport upstream fixes for HiKey 960 gralloc
- dr1 only: backport upstream changes for HiKey 960 SELinux support in enforcing mode
- SELinux policy: backport changes for timerslack support
- dr1 only: backport removal of device-specific timerslack support
- HiKey, HiKey 960: stop disabling malloc junk on free
- dr1 only: temporarily use zero fill on free in debug builds to work around unidentified bugs on HiKey / HiKey 960
- dr1 only: backport stub memtrack HAL for HiKey / HiKey 960
- dr1 only: backport add dt.img into BOARD_PACK_RADIOIMAGES
- dr1 only: fix release.sh for hikey960 target
- HiKey 960: update vendor files to 20170523
- drop device/linaro/hikey fork from non-dr1 branches as we'll only be maintaining it in dr1
- Settings: add WPA2 issues fixed in the last release (2017.10.16.22) to the "Extra security patches" field
- HiKey: add boot animation
- SELinux policy: backport init configfs fix for HiKey
- Settings: handle devices without factory reset protection
- HiKey: disable malloc junk on free until use-after-free bugs are addressed
- SELinux policy: fully remove base system dalvikcache_data_file execute again
- Chromium: update base version to 62.0.3202.66 from 61.0.3163.98 and port the hardening changes
- Net Monitor: update to v1.2 from v1.1.4 (fixes the major issues of missing connections when it was running in the background and wrongly attributing connections to apps with shared uids like assigning all system uid connections to atfwd)
- enable LOCAL_DEX_PREOPT for apks in vendor.img again
- SELinux policy: allow vendor apps to execute vendor_framework_file for dexpreopt to avoid needing /data/dalvik-cache
- backport wpa_supplicant security fixes for CVE-2017-13077, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13082, CVE-2017-13086, CVE-2017-13087 and CVE-2017-13088 (CVE-2017-13084 is not applicable) to Oreo's current post-2.6 revision
- Updater (Pixel, Pixel XL): stop setting the notification to CATEGORY_SYSTEM
- Silence: update from 0.15.7 to 0.15.8
- SELinux policy: auditallow legacy execmod
- Nexus 5X, Nexus 6P: only add Updater to PRODUCT_PACKAGES in official builds
- work around latent F-Droid bug with privileged extension app installation (bug is still present but no longer worse than before)
- SELinux policy: split out base system isolated_app again
- SELinux policy: begin purge of base system dalvikcache_data_file execute again
- SELinux policy: remove webview_zygote apk_data_file access
- Nexus 5X, Nexus 6P: add back missing vendor apps via improved android-prepare-vendor Oreo compatibility
- refactor checks for added runtime permissions (previously only used to make INTERNET into a runtime permission)
- add new permission for non-body-related sensors
- 2017-10-01 kernel security patch level
- 2017-10-05 kernel security patch level
- Nexus 5X, Nexus 6P: enforce privileged permission whitelisting (already enforced on Pixels)
- Updater: Update settings → System update settings
- SELinux policy: remove execmem for privileged app domains again
- SELinux policy: add seinfo tag for generic base system apps again
- SELinux policy: split out untrusted base app domains again
- SELinux policy: remove base system execmod again
- SELinux policy: remove base system untrusted app execmem again
- SELinux policy: remove base system app_data_file execute again
- kernel (Pixel, Pixel XL): add specialized MAC randomization for Pixel phones
- Settings (Pixel, Pixel XL): add new toggle for associated MAC randomization to Wi-Fi preferences
- SELinux policy: split out domain for Updater from priv_app domain again
- SELinux policy: remove ota update access from priv_app domain again
- SELinux policy: split netmonitor domain from untrusted_base_app again
- SELinux policy: split out basic routing / iface info from proc_net again
- SELinux policy: remove non-netmonitor untrusted_app_all / isolated_app proc_net access again
- Nexus 6P: update vendor files to OPR6.170623.019 from OPR6.170623.017 (2nd published September release)
- add support for HiKey as a build target
- Nexus 5X, Nexus 6P: log privileged permission whitelisting violations (already fully enforced on Pixels)
- F-Droid privileged extension: update to 0.2.7
- Nexus 6P: get audio_effects.conf from vendor instead again
- Nexus 6P: remove wpa_supplicant scanning MAC randomization as it no longer works
- Nexus 6P: remove kernel associated MAC randomization as it no longer works
- remove infrastructure for legacy kernel associated MAC randomization
- kernel: wcnss: fix 3 byte buffer overflow on MAC change
- Contacts: remove no-op help & feedback menu entries
- keyboard: rebranding
- fix logging for denials of background clipboard access
- Updater (Pixel, Pixel XL): always wait for reboot after completing an update
- Updater (Pixel, Pixel XL): switch to new system update icon for notification
- Updater (Nexus 5X, Nexus 6P): add makeshift legacy update system support (This update client was designed to run on top of the update_engine A/B update system and file-based encryption. It can't offer the same user experience and robustness elsewhere. However, due to some recent changes it's possible to hack in support for the legacy recovery-based update system. It will handle edge cases like a normal reboot after an update is downloaded strangely but the basics can work.)
- Updater (Nexus 5X, Nexus 6P): use legacy update server
- Nexus 5X, Nexus 6P: replace LegacyUpdater with Updater
- Chromium: update to 61.0.3163.98 from 61.0.3163.81
- keyboard: disable personalized suggestions by default
- Updater (Pixel, Pixel XL): use the standard update settings intent
- Nexus 5X, Nexus 6P: port to oreo
- LegacyUpdater (Nexus 5X, Nexus 6P): use the standard update settings intent
- Settings: use standard update settings mechanism
- Nexus 5X, Nexus 6P: vendor: remove system partition bytecode packages until they work properly (loses transparent WiFi / LTE switching on both and Qualcomm time service on 5X)
- wpa_supplicant: enable WiFi scanning MAC randomization for non-Qualcomm WiFi devices again (Qualcomm WiFi devices already have a better implementation in firmware)
- DeskClock: drop targetSdkVersion to 25 since Google released it as targeting 26 without handling the breaking changes
- Nexus 5X: fix preferred network settings
- full 2017-09-01 kernel security patch level (not just the kernel)
- full 2017-09-05 kernel security patch level (not just the kernel)
- 2017-09-01 kernel security patch level (other sources are inexplicably not published yet)
- 2017-09-05 kernel security patch level (other sources are inexplicably not published yet)
- Pixel, Pixel XL: remove fstab override made unnecessary by the wonders of Treble (still necessary for Nexus)
- Pixel, Pixel XL: build PresencePolling app (IMS / RCS related)
- Pixel, Pixel XL: build nanotool, libion and libminui from source instead of extracting with android-prepare-vendor
- Pixel, Pixel XL: avoid stripping out PixelThemeOverlay from vendor but don't enable it by default (AOSP keyboard doesn't support the theme like Gboard)
- Pixel, Pixel XL: remove unnecessary DiagMon priv-app
- libc: add back dynamic object size checking support without actually wiring it up to any system calls yet
- use permanent fingerprint lockout immediately
- Updater (Pixel, Pixel XL): reject any serialno constraint for stable / beta (serialno constraint is only for alternate update channels not exposed as standard update channel choices)
- Settings: do not allow disabling Chromium (it's very common for people to disable it without realizing Chromium provides the WebView to other apps)
- Settings: do not allow disabling the main keyboard (it's not obvious that disabling it after installing another keyboard is a very bad idea. Other keyboards rarely support Direct Boot and won't work for entering the password, forcing recovery by plugging in a physical keyboard)
- Updater (Pixel, Pixel XL): replace the notification channel to move away from deprecated APIs
- Updater (Pixel, Pixel XL): add permissions whitelist file
- disable OpenGL preloading again
- disable preload ICU cache pinning again
- disable JCA provider preloading again
- disable resource preloading again
- disable class preloading again
- add missing /system/etc/permissions and /system/etc/sysconfig configuration files from stock (via android-prepare-vendor)
- omit stock Android libtinyxml2 since it's part of AOSP (via android-prepare-vendor)
- remove CarrierSetup app as it appears to be unnecessary and tied to Verizon bloat / Google Play
- fix com.android.launcher3 permissions whitelist
- fix com.android.dialer permission whitelist
- fix android.ext.services permissions whitelist
- add com.android.apps.tag permission whitelist
- F-Droid privileged extension: update to 0.2.6
- F-Droid privileged extension: whitelist privileged permissions
- Pixel, Pixel XL: enforce privileged permission whitelisting
- backport upstream fix for the wrap debug feature
- Chromium: update to 61.0.3163.81 from 60.0.3112.116
- Chromium: backport support for the Android Oreo WebView
- Chromium: bump MonochromePublic targetSdkVersion to 26 to match the internal Monochrome metadata (needed to provide the WebView on Oreo among other things)
- remove Google WebView since our hardened Chromium builds provide the WebView again
- remove Google WebView from the WebView provider whitelist
- PDF Viewer: adopt targetSandboxVersion 2 to use the much stronger instant app style sandbox for the app itself (rendering already happened in the stronger WebView sandbox)
- Updater (Pixel, Pixel XL): migrate to Build.getSerial() API for enforcing update zip serialno constraints in anticipation of it becoming mandatory
- grant Updater app on Pixel and Pixel XL Phone permissions for Build.getSerial()
- leave deprecated Build.SERIAL field set to UNKNOWN (only support fetching the serial number via the new Build.getSerial() requiring the READ_PHONE_STATE permission)
- Chromium: update to 60.0.3112.116 from 60.0.3112.107
- Chromium WebView (temporarily included until Oreo WebView support is pushed): update to 60.0.3112.116 from 60.0.3112.107
- add two forms of ASLR for secondary stacks again
- make the minimum secondary stack gap size one page again
- kernel: getrandom: make blocking until init configurable (disabled temporarily to mimic the AOSP urandom fallback)
- move to Android Oreo OPR6.170623.013 the base OS (tip of oreo-r6-release branch)
- port of many of our features to Android Oreo (8.0), requiring many changes to the implementations (details not listed here)
- android-prepare-vendor port to Android Oreo / Treble and new vendor files
- add missing ro.hardware.egl property
- stop clobbering stock audio_effects.conf
- temporarily bundle and whitelist the AOSP WebView until Android Oreo support is pushed to Chromium
- add ambient capability support to exec-based spawning
- use exec-based spawning for com.android.bluetooth now that there's ambient capability support
- fix upstream issue with replacing the fingerprint of the boot image
- handle -ftrapv like the signed integer sanitizer options (signed-integer-overflow, integer, undefined) by not passing -fwrapv
- build new Clang toolchain
- switch back to using speed mode for dexpreopt globally rather than only for certain core code
- Launcher3: disable icon normalization for now as most icons aren't prepared for it
- disable aapt2 for LatinIME (the keyboard) to work around a known aapt2 bug
- increase padding from 16 to 32 bytes for the new AES_256_HEH filename encryption mode to match our increase from 4 to 32 bytes for the old AES_256_CTS mode (content is still encrypted with AES_256_XTS)
- Contacts: remove no-op help and feedback option
- Contacts: make add account message neutral about service choice
- Settings: add back extra security patch level field
- Settings: add back bootloader version field
- Settings: add back verified boot status field
- Settings: add back anti-theft protection status field
- Updater (Pixel, Pixel XL): add support for battery not low job scheduling
- remove shared relro support again
- Launcher3: work around keyboard not being hidden
- ExactCalculator: revert to the old Apache2 icon from before Google went out of the way to regress it in AOSP
- Contacts: remove logo meant for the Google app based on this
- recovery: rebranding
- script: remove minutes/seconds from generated BUILD_NUMBER
- temporarily bundle and whitelist the latest Google WebView until support for providing the WebView on Android Oreo is in Chromium
- bionic: replace brk/sbrk/__bionic_brk with stubs again
- Updater (Pixel, Pixel XL): move to new APIs provided at API level 26
- Updater (Pixel, Pixel XL): add a notification channel
- Updater (Pixel, Pixel XL): increase targetSdkVersion to 26
- stop disabling unprivileged ptrace by default for compatibility with the new crash dump system
- kernel (Pixel, Pixel XL): stop enabling ptrace_scope by default for compatibility with the new crash dump system
- CarrierConfig (Pixel, Pixel XL): update vendor.xml configuration overlay for Android Oreo
- roll back non-firewall network hardening too for the time being in case it's the source of carrier compatibility issues
- add toggle for disabling native code debugging support (toggles kernel.yama.ptrace_scope between 0 and 2, with more restrictions coming later)
- replace SELinux policy in vendor.img with our policy
- sepolicy: remove permissions tied to the Dalvik / ART JIT compiler again
- sepolicy: remove app_data_file execute for priv_app again
- sepolicy: add back fine-grained policy for /proc/vmstat
- sepolicy: disallow text relocations for API 26+
- sqlite: enable shift, signed-integer-overflow and object-size sanitizers in trapping mode again
- make some function pointer tables read-only again
- PDF Viewer: update targetSdkVersion to 26
- PDF Viewer: update pdf.js to 1.8.188
- fix undefined out-of-bounds accesses in sched.h again
- switch pthread_atfork handler to mmap again
- add memory protection for pthread_atfork handlers again
- add memory protection for at_quick_exit handlers again
- clean up string formatting in libc again
- increase pthread stack size to 8MiB on 64-bit again
- add XOR mangling mitigation for thread local destructors again
- avoid some variable length arrays again
- make __stack_chk_guard read-only at runtime again
- replace pthread_attr junk filling pattern again
- add explicit_memset and fix explicit_bzero with it again
- add a proper issetugid implementation again
- add back hardened malloc with assorted changes and integration
- temporarily disable junk on free for init
- whitelist getrandom system call for media seccomp sandboxes since hardened malloc triggers regular calls to it
- Updater (Pixel, Pixel XL): get payload offset from new streaming metadata
- zero sensitive data (512 byte hardware generated random seed) with explicit_memset in init again
- tighten up mount permissions again
- use blocking getrandom to prevent urandom fallback to prevent arc4random abort before urandom is available and to guarantee high quality early boot entropy