I put Secureblue on GrapheneOS. (plz help)

OutlawSanZhang

Finally, Secureblue VM on GrapheneOS.

I have been developing a fork of the Linux Terminal app, which runs Linux VMs using Android's virtualization framework.
The official Terminal app runs a Debian image downloaded from Google, so I made a fork, koiTerminal, that makes it a lot easier to run VM images that are... not that.
With it, I was able to build a Secureblue image and make it run on GrapheneOS (gen 7+ Pixels).
There are some kernel issues that I need help on (see thread), but it mostly works! Check it out:

koiTerminal

meowijuana

OutlawSanZhang I can't say for sure, but would an older SecureBlue image work better than a new release? Idk if older versions are publicly hosted or not. I do know that GrapheneOS’s kernel patches for security can occasionally break upstream virtualization features, especially when you move past a certain GKI version. So I would guess that an older image could be a less than perfect solution.

OutlawSanZhang

I do need help on the kernel. Right now, it seems that any kernel above 6.12 will not work on some devices but not others.
The reason is unclear to me. If anyone knowledgeable about Android kernels has any idea what the issue is about, it would be of great help!

Issue page

OutlawSanZhang

meowijuana
I probably need help more on making current or LTS kernels work than using older kernels. I imagine that using an old Secureblue image would be worse than having an outdated kernel, because everything else would be outdated too.

Do you happen to know any document or report that talks about GrapheneOS's patches breaking virtualization?

void0
Not for the current Secureblue image. Right now it is downloaded from Fedora's build system. Secureblue reuses Fedora's kernels. But I am planning to look into how to build an LTS kernel as a Fedora RPM. Officially, Fedora only supports building a few versions close to kernel mainline, so there is some work involved. From what you say, I can also try building the 6.19 kernel with different configs. However, when making the Alpine image, I did build the vanilla kernel using both mainline and 6.12 LTS, and only the mainline kernel works.

void0

Just to verify, are you building the kernels from source? If so I do have a bit of experience in this field.

Without a proper stacktrace you should start by comparing the preexisting config to that of say 'make localmodconfig'. There is likely some flag which was enabled or disabled which is required in newer iterations. I am 99% sure if you copy the config from the old kernel (6.12) to the newer kernel (6.19) you should be able to boot fine.