11d2a3d784
cgwatch.sh respawns ratlock/cgdetect within ~30s if either dies (crash, OOM, accidental kill), so the guard self-heals instead of staying down until the next reboot. service.sh now launches the supervisor after the RIL-up wait rather than starting the two daemons directly.
52 lines
1.9 KiB
Bash
Executable File
52 lines
1.9 KiB
Bash
Executable File
#!/system/bin/sh
|
|
# CellGuard — late service script
|
|
#
|
|
# Primary goal: (1) prevent cellular downgrade — hold the modem to LTE + 5G(NR)
|
|
# only; (2) detect IMSI-catchers / cell-site simulators from the modem's own
|
|
# CP<->AP diagnostic stream.
|
|
#
|
|
# On rango (Shannon S5400 / cpif, PCIe) there is NO raw-AT tty and no exposed
|
|
# SIT command to inject, so:
|
|
# * enforcement uses the platform telephony API (ratlock.sh)
|
|
# * diagnostics use a kernel capture module (cgcap.ko) that taps every cpif
|
|
# channel and exposes the raw frames at /proc/cgcap/frames
|
|
# * decode + CSS heuristics run in userspace (tools/cg_decode.py)
|
|
|
|
MODDIR=${0%/*}
|
|
CONFIG_DIR="/data/adb/cellguard"
|
|
LOG="$CONFIG_DIR/cellguard.log"
|
|
KMOD="$MODDIR/common/kmod/cgcap.ko"
|
|
|
|
mkdir -p "$CONFIG_DIR"
|
|
log() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" >> "$LOG"; }
|
|
|
|
log "CellGuard service start"
|
|
|
|
# --- 1. diagnostics: load the CP-frame capture module ---
|
|
if lsmod 2>/dev/null | grep -q '^cgcap '; then
|
|
log "cgcap already loaded"
|
|
elif [ -f "$KMOD" ]; then
|
|
insmod "$KMOD" 2>>"$LOG" && log "cgcap.ko loaded (diag at /proc/cgcap/frames)" \
|
|
|| log "cgcap.ko insmod FAILED — check dmesg (is cpif up?)"
|
|
else
|
|
log "cgcap.ko missing at $KMOD — build it first"
|
|
fi
|
|
|
|
# --- 2. wait briefly for RIL/subscriptions to come up after boot ---
|
|
# (enforcement needs the telephony API to be live before it can set RAT).
|
|
for i in $(seq 1 30); do
|
|
[ -n "$(cmd phone get-allowed-network-types-for-users -s 0 2>/dev/null)$(cmd phone get-allowed-network-types-for-users -s 1 2>/dev/null)" ] && break
|
|
sleep 1
|
|
done
|
|
|
|
# --- 3. supervisor: starts + keeps alive both enforcement (ratlock) and
|
|
# detection (cgdetect) daemons, respawning either if it dies. ---
|
|
if ! pgrep -f cgwatch.sh >/dev/null 2>&1; then
|
|
setsid sh "$MODDIR/cgwatch.sh" </dev/null >/dev/null 2>&1 &
|
|
log "cgwatch supervisor started (respawns ratlock + cgdetect)"
|
|
else
|
|
log "cgwatch already running"
|
|
fi
|
|
|
|
log "CellGuard service done"
|