In a recent update to LineageOS, something in the kernel has changed that makes SafetyNet not pass with Magisk alone. I discovered that this has something to do with SafetyNet checking the device fingerprint.
Note that there are a number of reasons that SafetyNet would not pass even with Magisk installed. This particular issue can be identified by
ctsProfile being false in the SafetyNet check feature of Magisk Manager even though
basicIntegrity is true. If
basicIntegrity is false on your device, this is not the right solution for you!
There is a relatively easy fix, but it is hard to find because it gets buried by all the typical old MagiskHide solutions on Google. Hopefully some will find this post helpful.
Basically, what needs to be done is changing the device fingerprint to one that is in a Google-verified database. This can be done by editing prop files by hand, but an easy way I found is by using the Magisk Module MagiskHide Props Config. This can be downloaded from the Downloads section inside of Magisk Manager. You will also need to install a BusyBox module, such as this one by osm0sis, also available in the Downloads section of Magisk Manager.
After installation, you do actually need to reboot the device before continuing.
To use your new module to replace the device fingerprint, you need to access the command line either with the built-in Terminal app in LineageOS or through
adb shell. Enter the command
props to bring up the menu for MagiskHide Props Config. What we want is Edit Device Fingerprint (option 1). Enter
f to choose a certified fingerprint, and then you can choose a manufacturer and device to use for your fingerprint. I am not sure how much the fingerprint you choose actually matters, but my notion is to choose a fingerprint as close to your actual device as possible. In my case, I am using a Nexus 6P, so I was able to select the fingerprint of the official Google OS for the same device. After you press
y to confirm the fingerprint you have selected, you will have the option to turn on "basic device emulation". You don't need this for the fingerprint to take effect, so just select
y for yes at this stage without pressing
d. The device does need to be rebooted again for the new fingerprint to take effect, but after that you should be able to see
ctsProfile: true in Magisk Manager.