Security Policy
Relevant source files
The following files were used as context for generating this wiki page:
The KernelForge security policy defines the standards for version support, vulnerability reporting, and the integration of kernel-level security features. The project focuses on providing a secure environment for Android kernel development by automating the inclusion of filesystem hiding and root management frameworks while maintaining community safety standards.
Sources: SECURITY.md, README.md:1-12
Supported Versions
KernelForge maintains security updates for specific versions to ensure stability and protection against exploits.
| Version | Supported |
|---|---|
| 5.1.x | :white_check_mark: |
| 5.0.x | :x: |
| 4.0.x | :white_check_mark: |
| < 4.0 | :x: |
Sources: SECURITY.md:5-12
Vulnerability Management
Users and developers must report security vulnerabilities directly to the community leaders. The project prioritizes the privacy and security of the reporter during the investigation process.
Reporting Process
Instances of abusive, harassing, or unacceptable behavior, as well as technical vulnerabilities, should be reported to the community leader at JWEB0689. All reports undergo a prompt and fair review.
Sources: CODE_OF_CONDUCT.md:59-64
The diagram shows the lifecycle of a security report from discovery to the release of a patch.
Integrated Kernel Security Features
The application provides a dashboard to configure specialized security and root-hiding modules during the kernel compilation process.
Patching Modules
- KernelSU: Integrates kernel-level root access. Users choose between "Official" stable variants or "Next" experimental variants.
- SUSFS: Implements advanced filesystem hiding to prevent detection of modifications.
- NoMount: Prevents detection by blocking specific mounting behaviors in
fs/namespace.c. - CFI Security: Provides Control Flow Integrity to mitigate memory corruption vulnerabilities.
Sources: src/app/page.tsx:69-74, src/app/page.tsx:462, README.md:9-10
This flowchart illustrates how security features are selected and integrated into the build configuration.
Software Supply Chain Security
KernelForge uses automated pipelines to ensure the integrity of the distributed APKs.
- Static Payload Compilation: The Next.js frontend is compiled into a static payload.
- Capacitor Injection: The payload is injected into the Android wrapper.
- Signing: The pipeline aligns and signs the
arm64-v8aAPK before publication. - GitHub Actions: The project references security hardening for GitHub Actions to protect the CI/CD environment.
Sources: README.md:21-31, CONTRIBUTING.md:38-39
AI Troubleshooting Security
The AI Troubleshooting Assistant operates in a limited capacity within the static Android APK to maintain security and portability.
- Static Export Mode: The application runs without a backend server in the mobile environment.
- Mock Analysis: Because the APK lacks a local backend, AI analysis for logs is simulated unless a remote AI endpoint is configured by the user.
- Data Exposure: Providing a remote endpoint allows for real log analysis but requires the user to manage the security of that external connection.
Sources: src/ai/flows/ai-build-troubleshooting-assistant.ts:40-57
The sequence diagram details the interaction between the user and the AI assistant, highlighting the security boundaries of the static export.
Community Enforcement Standards
Security extends to the community environment through the enforcement of the Contributor Covenant. Community leaders have the authority to remove or reject contributions that violate security or safety standards.
Consequences for Violations
- Correction: Private warning for unprofessional behavior.
- Warning: Interaction restrictions for a specified period.
- Temporary Ban: Ban from public interaction for a serious violation.
- Permanent Ban: Permanent removal for sustained patterns of harassment or aggression.
Sources: CODE_OF_CONDUCT.md:66-105
Conclusion
The Security Policy for KernelForge-App combines technical kernel hardening (KernelSU, SUSFS, CFI) with robust community enforcement and supply chain automation via GitHub Actions. By maintaining support for versions 5.1.x and 4.0.x, the project ensures that users have access to verified security patches while discouraging the use of deprecated versions.