ekipyt

MEDIUM

maintainer Ekip 0 votes scanned 2026-09-08 13:17:19.099707

View on AUR

Why flagged

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

Triggered rules

Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

.install:3 chmod 4755 /usr/bin/yt

PKGBUILD

      1# The MIT License (MIT)
    
      2# Copyright © 2026 Yalçın Mete Kızılgün
    
      3
    
      4# Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
    
      5
    
      6# The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
    
      7
    
      8# THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
    
      9
    
      10# Maintainer: Yalçın Mete Kızılgün <kizilgunmete@gmail.com>
    
      11pkgname=ekipyt
    
      12pkgver=1.1
    
      13pkgrel=2
    
      14pkgdesc="Minimal ve güvenli yetki aracı, onepass ve custom PAM servisi ile"
    
      15arch=('x86_64')
    
      16url="https://github.com/Hardcore-Team/yt-source" 
    
      17license=('MIT')
    
      18depends=('pam' 'gcc')
    
      19sha256sums=('e2e1ffc0c146ed5d6a08cf738ffa61398f04d7ffb4ae63fb1669a51d7a2b9073'
    
      20            '146e04aa05345680dd6c220630390432bf45009fcf94a347131d9c311875027e'
    
      21            'dc17b21c82ef63f4351cb66b8f1a3324843eef82404790773796c1f1ac6aefa3')
    
      22source=("yt.c" "yt.cfg" "yt.pam")
    
      23install=ekipyt.install
    
      24
    
      25build() {
    
      26    # -D_FORTIFY_SOURCE=2, -fstack-protector-strong: tampon taşması tespiti
    
      27    # -z relro -z now: GOT'u salt-okunur yap, symbol'leri eager bind et
    
      28    # -pie: adres uzayı rastgeleleştirmesinden (ASLR) tam yararlan
    
      29    # Bunlar SUID-root bir binary için standart sertleştirme bayraklarıdır.
    
      30    gcc -Wall -Wextra -O2 -D_FORTIFY_SOURCE=2 -fstack-protector-strong -fPIE \
    
      31        -Wl,-z,relro,-z,now -pie \
    
      32        -o yt yt.c -lpam -lpam_misc
    
      33}
    
      34
    
      35package() {
    
      36    # Binary kur
    
      37    install -Dm755 yt "$pkgdir/usr/bin/yt"
    
      38
    
      39    # Root-only config, default onepass
    
      40    install -Dm600 yt.cfg "$pkgdir/etc/yt.cfg"
    
      41    chown root:root "$pkgdir/etc/yt.cfg"
    
      42
    
      43    # Onepass dizini (boş)
    
      44    install -d -m700 "$pkgdir/tmp/yt_onepass"
    
      45
    
      46    # PAM servisi kur
    
      47    install -Dm644 yt.pam "$pkgdir/etc/pam.d/yt"
    
      48    chown root:root "$pkgdir/etc/pam.d/yt"
    
      49}
    
      50

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-09-08 13:17
@@ -9,21 +9,27 @@
 
 # Maintainer: Yalçın Mete Kızılgün <kizilgunmete@gmail.com>
 pkgname=ekipyt
-pkgver=1.0
-pkgrel=1
+pkgver=1.1
+pkgrel=2
 pkgdesc="Minimal ve güvenli yetki aracı, onepass ve custom PAM servisi ile"
 arch=('x86_64')
-url="" 
+url="https://github.com/Hardcore-Team/yt-source" 
 license=('MIT')
-depends=('pam')
-sha256sums=('6dc94b6e9f7d9170737df7d0ba65ee0308a263ecb8150c949047428371dee8a8'
+depends=('pam' 'gcc')
+sha256sums=('e2e1ffc0c146ed5d6a08cf738ffa61398f04d7ffb4ae63fb1669a51d7a2b9073'
             '146e04aa05345680dd6c220630390432bf45009fcf94a347131d9c311875027e'
             'dc17b21c82ef63f4351cb66b8f1a3324843eef82404790773796c1f1ac6aefa3')
 source=("yt.c" "yt.cfg" "yt.pam")
 install=ekipyt.install
 
 build() {
-    gcc -Wall -O2 -o yt yt.c -lpam -lpam_misc
+    # -D_FORTIFY_SOURCE=2, -fstack-protector-strong: tampon taşması tespiti
+    # -z relro -z now: GOT'u salt-okunur yap, symbol'leri eager bind et
+    # -pie: adres uzayı rastgeleleştirmesinden (ASLR) tam yararlan
+    # Bunlar SUID-root bir binary için standart sertleştirme bayraklarıdır.
+    gcc -Wall -Wextra -O2 -D_FORTIFY_SOURCE=2 -fstack-protector-strong -fPIE \
+        -Wl,-z,relro,-z,now -pie \
+        -o yt yt.c -lpam -lpam_misc
 }
 
 package() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-08 13:17:19	Medium	1
2026-09-08 11:17:13	Medium	1
2026-06-18 16:11:54	Clean	0