Relock FP5 keeping LineageOS

[kzoip]

Hi there,

I unlocked my new FP5, then installed LineageOS 21 following succesully instructions provided here : https://support.fairphone.com/hc/en-us/articles/10492476238865-Manage-the-Bootloader

I would like to relock my phone for security reasons. I followed instructions at https://support.fairphone.com/hc/en-us/articles/10492476238865-Manage-the-Bootloader / " Optional: Lock your bootloader"

• fastboot flashing lock_critical worked (with phone confirmation):

• Then, I made a fastboot flashing lock successfully (with phone confirmation) and rebooted. My phone was then unable to boot (" Your device is corrupt. It can’t be trusted and may not work properly.") red message. I had to unlock it and thus reinstall LineageOS.

• Current state :

$ fastboot oem device-info                                                                                                                                                                       (bootloader) Verity mode: false
(bootloader) Device unlocked: true
(bootloader) Device critical unlocked: false
(bootloader) Charger screen enabled: true
OKAY [  0.000s]

Did someone manage to relock a non-stock ROM on a FP 5 ?

[OldRoutard]

Welcome to the forum and the community.

I’ve an idea that the problem here will be the Android security patch level. The SPL of the ROM you install needs to be the same or later than that of the ROM that you’re replacing. If you had just updated FPOS before flashing Lineage that’s a likely problem situation.

However I’m no expert so let’s try and contact someone who is! @hirnsushi are you there?

In the mean time kzoip, can you report back with the previous FPOS version you had on the phone?

[Volker]

Regarding LineageOS and relocking the bootloader you might also be interested in this article:
https://www.reddit.com/r/LineageOS/comments/n7yo7u/a_discussion_about_bootloader_lockingunlocking/

And in case you continue trying to lock it, always check if get_unlock_ability is 1 before you start your attempt. If not you might hard brick your device.

[yvmuell]

Lineage does not support relocking the bootloader,

https://wiki.lineageos.org/faq#canshould-i-relock-my-bootloader

discussed for the FP4 e.g. here

Official LineageOS 20 FP4

If you plan on installing LOS and want to lock your bootloader you’ll have to build your own images, that’s not supported by default. Large parts of the Android security model rely on a locked bootloader and there are apps that won’t run if it’s unlocked. There are several other ROMs (/e/OS, DivestOS, CalyxOS, iodéOS) that will let you lock your bootloader, but whatever you do check that fastboot flashing get_unlock_ability returns 1 right before you lock it! Oh and welcome to the community …

Or here

Official LineageOS 20 FP4

In theory yes, but they would have to set a custom root of trust, and I checked, flashing the avb_custom_key isn’t part of the Lineage installation.

[Volker]

@yvmuell

Lineage does not support relocking the bootloader

True.

@kzoip

Did someone manage to relock a non-stock ROM on a FP 5 ?

CalyxOS and Murena (/e/OS) users did (and possibly iodéOS too, don’t know).

[yvmuell]

Yes with IodeOS as well possible and done already

@fp_spter

have relocked the bootloader and with MicroG all the apps work as expected.

[kzoip]

Thanks for your response. I didn’t check the FP5 OS version before installing LineageOS but performed (as stated in the LineageOS documentation) an upgraded (from the regular Android GUI) before anything else so, I guess I had the last FP5 OS ( FP5.TT4D.A.157).

Installing Fairphone OS Manually

[kzoip]

Thanks. I may have a try. But I wonder : why would explain that these OS allow relocking and not LineageOS ? according to https://www.reddit.com/r/LineageOS/comments/n7yo7u/a_discussion_about_bootloader_lockingunlocking/ stateed before by OldRoutard (thanks to him), the problem is the fact that the hardware has none knowledge of the alternative ROM private key. Why would PF5 support some alternative ROM private key and not the LineageOS (which is AFAIK the most widespread) ?

[kzoip]

Another subject I find interesting but still unclear to me is the fact that -as stated- my phone is half locked/half unlocked : My critical partitions are locked ( Device critical unlocked: false) , through my bootloader is not.

Even https://www.reddit.com/r/LineageOS/comments/n7yo7u/a_discussion_about_bootloader_lockingunlocking/ doesn’t seem to speak about it AFAIK…

I very new to this suspect so maybe naive but I feel that it could mitigate the Evil Maid attacks risk because as stated in the FF doc [1], a critical partitions unlocking would wipe my data (my final goal) and I suppose that an attacker, even if he can tamper easily my bootloader has to alter as well my critical partitions to do something useful , thus wiping all my data all together, what do you think ?

[1] " Type in fastboot flashing unlock_critical and press Enter . Once again, follow the instructions on your Fairphone to finish unlocking. This action will wipe all the personal data on your phone."

[llluuuzzziii]

@kzoip

Why would PF5 support some alternative ROM private key and not the LineageOS (which is AFAIK the most widespread) ?

LOS has weekly updates that are not tested before release. If an error occurs while the bootloader is locked, it may not be possible to simply boot the previous ROM.

[SkewedZeppelin]

You should only relock on systems that support it (eg. GrapheneOS, CalyxOS, my DivestOS)

@llluuuzzziii

it may not be possible to simply boot the previous ROM.

When locked it should automatically fall back to the alternate slot after 7 failed boot attempts.