antimony-sandbox

MEDIUM

maintainer kkernick 0 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The .install script creates dedicated users, sets setuid bits on binaries, and assigns capabilities, which constitutes privileged system modifications outside normal pacman handling, posing a potential privilege escalation risk if the binaries are compromised.

Triggered rules

Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

.install:17 chmod ug+s /usr/bin/antimony
.install:18 chmod ug+s /usr/share/antimony/utilities/antimony-lockdown

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The .install script creates dedicated users, sets setuid bits on binaries, and assigns capabilities, which constitutes privileged system modifications outside normal pacman handling, posing a potential privilege escalation risk if the binaries are compromised.

PKGBUILD

      1# Maintainer: kkernick <kkernick at protonmail dot com>
    
      2pkgname=antimony-sandbox
    
      3pkgdesc="Sandbox Applications"
    
      4pkgver=6.0.1
    
      5pkgrel=1
    
      6
    
      7install=antimony.install
    
      8license=("Unlicense")
    
      9url="https://github.com/kkernick/antimony"
    
      10source=("git+$url#tag=$pkgver")
    
      11b2sums=("SKIP")
    
      12depends=(glibc bubblewrap libseccomp xdg-dbus-proxy sqlite dbus)
    
      13makedepends=(git cargo pkgconf zstd gzip)
    
      14arch=("any")
    
      15
    
      16prepare() {
    
      17  cd $srcdir/antimony
    
      18  export RUSTUP_TOOLCHAIN=stable
    
      19  cargo fetch --target "$(rustc -vV | sed -n 's/host: //p')"
    
      20}
    
      21
    
      22build() {
    
      23  cd $srcdir/antimony
    
      24  export RUSTUP_TOOLCHAIN=stable
    
      25  export CARGO_TARGET_DIR=target
    
      26  cargo build --frozen --release --workspace
    
      27}
    
      28
    
      29check() {
    
      30  cd $srcdir/antimony
    
      31  export RUSTUP_TOOLCHAIN=stable
    
      32  export CARGO_TARGET_DIR=target
    
      33  cargo test
    
      34}
    
      35
    
      36package() {
    
      37  cd $srcdir/antimony
    
      38  install -Dm755 "target/release/antimony" "$pkgdir/usr/bin/antimony"
    
      39
    
      40  for binary in antimony-monitor antimony-spawn antimony-dumper antimony-open antimony-tracer antimony-notify antimony-writer antimony-lockdown antimony-landlock; do
    
      41    install -Dm755 "target/release/$binary" "$pkgdir/usr/share/antimony/utilities/$binary"
    
      42  done
    
      43
    
      44  for profile in $(ls config/profiles); do
    
      45	  install -Dm644 "config/profiles/$profile" "$pkgdir/usr/share/antimony/config/profiles/$profile"
    
      46  done
    
      47
    
      48  for feature in $(ls config/features); do
    
      49	  install -Dm644 "config/features/$feature" "$pkgdir/usr/share/antimony/config/features/$feature"
    
      50  done
    
      51
    
      52  install -Dm644 "config/default.toml" "$pkgdir/usr/share/antimony/config/profiles/default.toml"
    
      53  install -Dm644 "config/profile.toml" "$pkgdir/usr/share/antimony/config/profile.toml"
    
      54  install -Dm644 "config/feature.toml" "$pkgdir/usr/share/antimony/config/feature.toml"
    
      55
    
      56  install -Dm644 "config/config.toml" "$pkgdir/etc/antimony.toml"
    
      57  install -Dm644 "config/config.d/base.toml" "$pkgdir/etc/antimony.d/base.toml"
    
      58
    
      59
    
      60  # Build the shell completions
    
      61  target/release/antimony_generator
    
      62  install -Dm644 "generated/antimony.bash" "$pkgdir/usr/share/bash-completion/antimony"
    
      63  install -Dm644 "generated/antimony.fish" "$pkgdir/usr/share/fish/vendor_completions.d/antimony.fish"
    
      64  install -Dm644 "generated/_antimony" "$pkgdir/usr/share/zsh/site-functions/_antimony"
    
      65}
    
      66

Changes since previous scan

--- PKGBUILD @ 2026-10-23 00:02
+++ PKGBUILD @ 2026-11-01 00:21
@@ -1,7 +1,7 @@
 # Maintainer: kkernick <kkernick at protonmail dot com>
 pkgname=antimony-sandbox
 pkgdesc="Sandbox Applications"
-pkgver=6.0.0
+pkgver=6.0.1
 pkgrel=1
 
 install=antimony.install

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 03:36:21	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 00:06:47	Medium	2