CellGuard/service.sh

#!/system/bin/sh
# CellGuard — late service script
#
# Primary goal: (1) prevent cellular downgrade — hold the modem to LTE + 5G(NR)
# only; (2) detect IMSI-catchers / cell-site simulators from the modem's own
# CP<->AP diagnostic stream.
#
# On rango (Shannon S5400 / cpif, PCIe) there is NO raw-AT tty and no exposed
# SIT command to inject, so:
#   * enforcement uses the platform telephony API (ratlock.sh)
#   * diagnostics use a kernel capture module (cgcap.ko) that taps every cpif
#     channel and exposes the raw frames at /proc/cgcap/frames
#   * decode + CSS heuristics run in userspace (tools/cg_decode.py)

MODDIR=${0%/*}
CONFIG_DIR="/data/adb/cellguard"
LOG="$CONFIG_DIR/cellguard.log"
KMOD="$MODDIR/common/kmod/cgcap.ko"

mkdir -p "$CONFIG_DIR"
log() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" >> "$LOG"; }

log "CellGuard service start"

# --- 1. diagnostics: load the CP-frame capture module ---
if lsmod 2>/dev/null | grep -q '^cgcap '; then
  log "cgcap already loaded"
elif [ -f "$KMOD" ]; then
  insmod "$KMOD" 2>>"$LOG" && log "cgcap.ko loaded (diag at /proc/cgcap/frames)" \
    || log "cgcap.ko insmod FAILED — check dmesg (is cpif up?)"
else
  log "cgcap.ko missing at $KMOD — build it first"
fi

# --- 2. wait briefly for RIL/subscriptions to come up after boot ---
# (enforcement needs the telephony API to be live before it can set RAT).
for i in $(seq 1 30); do
  [ -n "$(cmd phone get-allowed-network-types-for-users -s 0 2>/dev/null)$(cmd phone get-allowed-network-types-for-users -s 1 2>/dev/null)" ] && break
  sleep 1
done

# --- 3. supervisor: starts + keeps alive both enforcement (ratlock) and
#         detection (cgdetect) daemons, respawning either if it dies. ---
if ! pgrep -f cgwatch.sh >/dev/null 2>&1; then
  setsid sh "$MODDIR/cgwatch.sh" </dev/null >/dev/null 2>&1 &
  log "cgwatch supervisor started (respawns ratlock + cgdetect)"
else
  log "cgwatch already running"
fi

log "CellGuard service done"