elasticsearch
LOW
maintainer ipaqmaster
11 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The flagged pattern involves creating symlinks and directories under /usr, but this is standard packaging behavior for installing Elasticsearch; no actual privileged operations or self-updates are performed outside of pacman's control.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The flagged pattern involves creating symlinks and directories under /usr, but this is standard packaging behavior for installing Elasticsearch; no actual privileged operations or self-updates are performed outside of pacman's control.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
Privileged / out-of-pacman install (sudoers, setuid, or self-update)
privileged_install
The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.
-
PKGBUILD:65
chmod 2750 "$pkgdir"/etc/elasticsearch
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: HLFH <gaspard@dhautefeuille.eu>
2
3
pkgname=elasticsearch
4
pkgver=9.5.5
5
pkgrel=1
6
pkgdesc="Free and Open, Distributed, RESTful Search Engine"
7
arch=('aarch64' 'x86_64')
8
url="https://www.elastic.co/elasticsearch/"
9
license=('custom:Elastic-2.0')
10
depends=('jdk21-openjdk' 'libxml2')
11
makedepends=()
12
provides=("elasticsearch=$pkgver")
13
conflicts=('elasticsearch7' 'elasticsearch-bin')
14
source=(
15
$pkgname-$pkgver.tar.gz::"https://github.com/elastic/elasticsearch/archive/v${pkgver}.tar.gz"
16
elasticsearch.service
17
elasticsearch@.service
18
elasticsearch-keystore.service
19
elasticsearch-keystore@.service
20
elasticsearch-sysctl.conf
21
elasticsearch-user.conf
22
elasticsearch-tmpfile.conf
23
elasticsearch.default
24
)
25
b2sums=('dea56f3cfa3522e8b3012f79bb159bdf30a7ef145fe791ed2e7e5fec35158a919743f5a54b00230ba133c866016091fe607ba9efb993b3627cc92329dfc7f6bd'
26
'76e4098c4f2c0656e70590997ada2e489c53b61386fb92524ac34e09b7fd43b511e2305047754bba29883d388fec4855dd8fc429e0e3aa93068ab671b6bd1a79'
27
'9b74e7ae392132056ab5e8a9e2637d71564fe736d10c16e07395878c4ef0a5498147d8a5b7a28dac6ef3722bc525bb8a57b01f9e185613c46c4f34f3a69990c8'
28
'48a332da75e1d8c7624a5948c4b145ad6ec6aca7ed2da31802920fa99490cc99a354e06d635b8937217404bcb99302f8d95b7af99d6af8e3227e39cdb80fa3cd'
29
'91ca815aa29f619e74b8d735af234705aed7254e4ecdde5248ab2a971a6b13e4c3897ed54933b2d68d3f16c266cd20d6ce14377f988199c367c39b892ddf5bca'
30
'5690e288a5d288931094db9e1532737b641d9852c2dc5cf45c2853e20c6ab013b1cf056f2cd325ad0703c2075dac7bd16c99c7f1ba202f5d94aac336508f7417'
31
'21cc254940924675bd24e07f6af1f58c89530abfb075637279798bdbba80772c6a4659361e9e8e58a5b2a5ffb21e55e40c91a270ff10da5ab467f63ce34e9f76'
32
'b54cc37b1e5b4f054fc14d3112bee2cbad1ba48f7f15364366473753767fa74f38874da35083f9f7d840286052d3da970cdcf509569aa8b5fff39e4941959678'
33
'f346ba285e045e3982da1841adc8625ebf1a662882d20a7c69bd76911782e1bdf30883b16dffe32cd2355349738b9b6c275b9ff6b11dfdd7fd56b509bcd19c31')
34
35
backup=('etc/elasticsearch/elasticsearch.yml'
36
'etc/elasticsearch/log4j2.properties'
37
'etc/elasticsearch/jvm.options'
38
'etc/default/elasticsearch')
39
40
build() {
41
cd $pkgname-$pkgver
42
echo "Building using java-21-openjdk..."
43
# For now as jdk-openjdk upgraded to JDK21 experiencing warnings treated as errors.
44
export JAVA_HOME=/usr/lib/jvm/java-21-openjdk
45
./gradlew --no-daemon :modules:systemd:assemble
46
./gradlew --no-daemon :distribution:archives:linux-tar:assemble
47
}
48
49
package() {
50
cd $pkgname-$pkgver
51
52
53
mkdir -p distribution/archives/linux-tar/build/install/
54
tar -xf "distribution/archives/linux-tar/build/distributions/${pkgname}-${pkgver}-SNAPSHOT-linux-x86_64.tar.gz" -C "distribution/archives/linux-tar/build/install/"
55
56
install -dm755 "$pkgdir"/{usr/share,var/lib,var/log}/elasticsearch
57
install -dm755 "$pkgdir"/usr/bin
58
59
cp -R "${srcdir}/${pkgname}-${pkgver}/distribution/archives/linux-tar/build/install/${pkgname}-${pkgver}-SNAPSHOT/." "${pkgdir}/usr/share/elasticsearch"
60
rm -r "$pkgdir"/usr/share/elasticsearch/{jdk,logs}
61
62
install -dm755 "$pkgdir"/etc
63
echo 'path.data: /var/lib/elasticsearch' >> "$pkgdir"/usr/share/elasticsearch/config/elasticsearch.yml
64
mv "$pkgdir"/usr/share/elasticsearch/config "$pkgdir"/etc/elasticsearch
65
chmod 2750 "$pkgdir"/etc/elasticsearch
66
67
for bin in "$pkgdir"/usr/share/elasticsearch/bin/*; do
68
ln -sT /usr/share/elasticsearch/bin/$(basename $bin) "$pkgdir"/usr/bin/$(basename $bin)
69
done
70
71
ln -s /etc/elasticsearch "$pkgdir"/usr/share/elasticsearch/config
72
ln -s /var/log/elasticsearch "$pkgdir"/usr/share/elasticsearch/logs
73
74
## Dynamically determine what version jdk-openjdk provides and symlink it.
75
# Good automation attempt but cannot be used. Elasticsearch falls behind java updates too often for a rolling release platform.
76
#jdk_openjdk_version=$(pacman -Ql java-runtime | grep -Pom1 '/usr/lib/jvm/java-[0-9]+-openjdk/')
77
#[ -z "${jdk_openjdk_version}" ] && echo "Unable to determine jdk-openjdk version automatically" && exit 1
78
#ln -s "${jdk_openjdk_version}" "$pkgdir"/usr/share/elasticsearch/jdk
79
ln -s "/usr/lib/jvm/java-21-openjdk" "$pkgdir"/usr/share/elasticsearch/jdk
80
81
install -Dm644 "$srcdir"/elasticsearch.service "$pkgdir"/usr/lib/systemd/system/elasticsearch.service
82
install -Dm644 "$srcdir"/elasticsearch@.service "$pkgdir"/usr/lib/systemd/system/elasticsearch@.service
83
install -Dm644 "$srcdir"/elasticsearch-keystore.service "$pkgdir"/usr/lib/systemd/system/elasticsearch-keystore.service
84
install -Dm644 "$srcdir"/elasticsearch-keystore@.service "$pkgdir"/usr/lib/systemd/system/elasticsearch-keystore@.service
85
install -Dm644 "$srcdir"/elasticsearch-user.conf "$pkgdir"/usr/lib/sysusers.d/elasticsearch.conf
86
install -Dm644 "$srcdir"/elasticsearch-tmpfile.conf "$pkgdir"/usr/lib/tmpfiles.d/elasticsearch.conf
87
install -Dm644 "$srcdir"/elasticsearch-sysctl.conf "$pkgdir"/usr/lib/sysctl.d/60-elasticsearch.conf
88
install -Dm644 "$srcdir"/elasticsearch.default "$pkgdir"/etc/default/elasticsearch
89
90
sed -i '2iJAVA_HOME=/usr/lib/jvm/default-runtime' "$pkgdir"/usr/share/elasticsearch/bin/elasticsearch-env
91
sed -i 's/ES_BUNDLED_JDK=true/ES_BUNDLED_JDK=false/g' "$pkgdir"/usr/share/elasticsearch/bin/elasticsearch-env
92
93
install -Dm644 LICENSE.txt "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.txt"
94
}
95
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |