elasticsearch

LOW

maintainer ipaqmaster 11 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The flagged pattern involves creating system users and directories with specific permissions via sysusers.d and tmpfiles.d, which is standard for daemon packages and not inherently dangerous; the package builds from official source and does not execute untrusted code or modify system configuration beyond typical service setup.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The flagged pattern involves creating system users and directories with specific permissions via sysusers.d and tmpfiles.d, which is standard for daemon packages and not inherently dangerous; the package builds from official source and does not execute untrusted code or modify system configuration beyond typical service setup.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

PKGBUILD:65 chmod 2750 "$pkgdir"/etc/elasticsearch

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:  HLFH <gaspard@dhautefeuille.eu>
    
      2
    
      3pkgname=elasticsearch
    
      4pkgver=9.5.4
    
      5pkgrel=1
    
      6pkgdesc="Free and Open, Distributed, RESTful Search Engine"
    
      7arch=('aarch64' 'x86_64')
    
      8url="https://www.elastic.co/elasticsearch/"
    
      9license=('custom:Elastic-2.0')
    
      10depends=('jdk21-openjdk' 'libxml2')
    
      11makedepends=()
    
      12provides=("elasticsearch=$pkgver")
    
      13conflicts=('elasticsearch7' 'elasticsearch-bin')
    
      14source=(
    
      15  $pkgname-$pkgver.tar.gz::"https://github.com/elastic/elasticsearch/archive/v${pkgver}.tar.gz"
    
      16  elasticsearch.service
    
      17  elasticsearch@.service
    
      18  elasticsearch-keystore.service
    
      19  elasticsearch-keystore@.service
    
      20  elasticsearch-sysctl.conf
    
      21  elasticsearch-user.conf
    
      22  elasticsearch-tmpfile.conf
    
      23  elasticsearch.default
    
      24)
    
      25b2sums=('242e69267a631bd088aa3a2c166e4f0f491b4a2bedb7b3312a9533dabe5b3dbc19ca3c7ded0aa74dc020770ac7e374e05606ac236dbc1aa166476a27a712177e'
    
      26        '76e4098c4f2c0656e70590997ada2e489c53b61386fb92524ac34e09b7fd43b511e2305047754bba29883d388fec4855dd8fc429e0e3aa93068ab671b6bd1a79'
    
      27        '9b74e7ae392132056ab5e8a9e2637d71564fe736d10c16e07395878c4ef0a5498147d8a5b7a28dac6ef3722bc525bb8a57b01f9e185613c46c4f34f3a69990c8'
    
      28        '48a332da75e1d8c7624a5948c4b145ad6ec6aca7ed2da31802920fa99490cc99a354e06d635b8937217404bcb99302f8d95b7af99d6af8e3227e39cdb80fa3cd'
    
      29        '91ca815aa29f619e74b8d735af234705aed7254e4ecdde5248ab2a971a6b13e4c3897ed54933b2d68d3f16c266cd20d6ce14377f988199c367c39b892ddf5bca'
    
      30        '5690e288a5d288931094db9e1532737b641d9852c2dc5cf45c2853e20c6ab013b1cf056f2cd325ad0703c2075dac7bd16c99c7f1ba202f5d94aac336508f7417'
    
      31        '21cc254940924675bd24e07f6af1f58c89530abfb075637279798bdbba80772c6a4659361e9e8e58a5b2a5ffb21e55e40c91a270ff10da5ab467f63ce34e9f76'
    
      32        'b54cc37b1e5b4f054fc14d3112bee2cbad1ba48f7f15364366473753767fa74f38874da35083f9f7d840286052d3da970cdcf509569aa8b5fff39e4941959678'
    
      33        'f346ba285e045e3982da1841adc8625ebf1a662882d20a7c69bd76911782e1bdf30883b16dffe32cd2355349738b9b6c275b9ff6b11dfdd7fd56b509bcd19c31')
    
      34
    
      35backup=('etc/elasticsearch/elasticsearch.yml'
    
      36        'etc/elasticsearch/log4j2.properties'
    
      37        'etc/elasticsearch/jvm.options'
    
      38        'etc/default/elasticsearch')
    
      39
    
      40build() {
    
      41  cd $pkgname-$pkgver
    
      42  echo "Building using java-21-openjdk..."
    
      43  # For now as jdk-openjdk upgraded to JDK21 experiencing warnings treated as errors.
    
      44  export JAVA_HOME=/usr/lib/jvm/java-21-openjdk
    
      45  ./gradlew --no-daemon :modules:systemd:assemble
    
      46  ./gradlew --no-daemon :distribution:archives:linux-tar:assemble
    
      47}
    
      48
    
      49package() {
    
      50  cd $pkgname-$pkgver
    
      51
    
      52
    
      53  mkdir -p distribution/archives/linux-tar/build/install/
    
      54  tar -xf "distribution/archives/linux-tar/build/distributions/${pkgname}-${pkgver}-SNAPSHOT-linux-x86_64.tar.gz" -C "distribution/archives/linux-tar/build/install/"
    
      55
    
      56  install -dm755 "$pkgdir"/{usr/share,var/lib,var/log}/elasticsearch
    
      57  install -dm755 "$pkgdir"/usr/bin
    
      58  
    
      59  cp -R "${srcdir}/${pkgname}-${pkgver}/distribution/archives/linux-tar/build/install/${pkgname}-${pkgver}-SNAPSHOT/." "${pkgdir}/usr/share/elasticsearch"
    
      60  rm -r "$pkgdir"/usr/share/elasticsearch/{jdk,logs}
    
      61
    
      62  install -dm755 "$pkgdir"/etc
    
      63  echo 'path.data: /var/lib/elasticsearch' >> "$pkgdir"/usr/share/elasticsearch/config/elasticsearch.yml
    
      64  mv "$pkgdir"/usr/share/elasticsearch/config "$pkgdir"/etc/elasticsearch
    
      65  chmod 2750 "$pkgdir"/etc/elasticsearch
    
      66
    
      67  for bin in "$pkgdir"/usr/share/elasticsearch/bin/*; do
    
      68    ln -sT /usr/share/elasticsearch/bin/$(basename $bin) "$pkgdir"/usr/bin/$(basename $bin)
    
      69  done
    
      70
    
      71  ln -s /etc/elasticsearch "$pkgdir"/usr/share/elasticsearch/config
    
      72  ln -s /var/log/elasticsearch "$pkgdir"/usr/share/elasticsearch/logs
    
      73
    
      74  ## Dynamically determine what version jdk-openjdk provides and symlink it.
    
      75  # Good automation attempt but cannot be used. Elasticsearch falls behind java updates too often for a rolling release platform.
    
      76  #jdk_openjdk_version=$(pacman -Ql java-runtime | grep -Pom1 '/usr/lib/jvm/java-[0-9]+-openjdk/')
    
      77  #[ -z "${jdk_openjdk_version}" ] && echo "Unable to determine jdk-openjdk version automatically" && exit 1
    
      78  #ln -s "${jdk_openjdk_version}" "$pkgdir"/usr/share/elasticsearch/jdk
    
      79  ln -s "/usr/lib/jvm/java-21-openjdk" "$pkgdir"/usr/share/elasticsearch/jdk
    
      80
    
      81  install -Dm644 "$srcdir"/elasticsearch.service "$pkgdir"/usr/lib/systemd/system/elasticsearch.service
    
      82  install -Dm644 "$srcdir"/elasticsearch@.service "$pkgdir"/usr/lib/systemd/system/elasticsearch@.service
    
      83  install -Dm644 "$srcdir"/elasticsearch-keystore.service "$pkgdir"/usr/lib/systemd/system/elasticsearch-keystore.service
    
      84  install -Dm644 "$srcdir"/elasticsearch-keystore@.service "$pkgdir"/usr/lib/systemd/system/elasticsearch-keystore@.service
    
      85  install -Dm644 "$srcdir"/elasticsearch-user.conf "$pkgdir"/usr/lib/sysusers.d/elasticsearch.conf
    
      86  install -Dm644 "$srcdir"/elasticsearch-tmpfile.conf "$pkgdir"/usr/lib/tmpfiles.d/elasticsearch.conf
    
      87  install -Dm644 "$srcdir"/elasticsearch-sysctl.conf "$pkgdir"/usr/lib/sysctl.d/60-elasticsearch.conf
    
      88  install -Dm644 "$srcdir"/elasticsearch.default "$pkgdir"/etc/default/elasticsearch
    
      89
    
      90  sed -i '2iJAVA_HOME=/usr/lib/jvm/default-runtime' "$pkgdir"/usr/share/elasticsearch/bin/elasticsearch-env
    
      91  sed -i 's/ES_BUNDLED_JDK=true/ES_BUNDLED_JDK=false/g' "$pkgdir"/usr/share/elasticsearch/bin/elasticsearch-env
    
      92
    
      93  install -Dm644 LICENSE.txt "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.txt"
    
      94}
    
      95

Changes since previous scan

--- PKGBUILD @ 2026-09-16 00:03
+++ PKGBUILD @ 2026-09-17 00:27
@@ -1,7 +1,7 @@
 # Maintainer:  HLFH <gaspard@dhautefeuille.eu>
 
 pkgname=elasticsearch
-pkgver=9.5.3
+pkgver=9.5.4
 pkgrel=1
 pkgdesc="Free and Open, Distributed, RESTful Search Engine"
 arch=('aarch64' 'x86_64')
@@ -22,7 +22,7 @@
   elasticsearch-tmpfile.conf
   elasticsearch.default
 )
-b2sums=('d8ec7bc2e4974ad18646c62cbc8e192bdd9389a50d1b354622a53466f681c650822b91ce7ae017cdc05313a58225227e7363c45b24c7088853b4517923b50da9'
+b2sums=('242e69267a631bd088aa3a2c166e4f0f491b4a2bedb7b3312a9533dabe5b3dbc19ca3c7ded0aa74dc020770ac7e374e05606ac236dbc1aa166476a27a712177e'
         '76e4098c4f2c0656e70590997ada2e489c53b61386fb92524ac34e09b7fd43b511e2305047754bba29883d388fec4855dd8fc429e0e3aa93068ab671b6bd1a79'
         '9b74e7ae392132056ab5e8a9e2637d71564fe736d10c16e07395878c4ef0a5498147d8a5b7a28dac6ef3722bc525bb8a57b01f9e185613c46c4f34f3a69990c8'
         '48a332da75e1d8c7624a5948c4b145ad6ec6aca7ed2da31802920fa99490cc99a354e06d635b8937217404bcb99302f8d95b7af99d6af8e3227e39cdb80fa3cd'

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 19:23:36	Medium	1
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 17:54:21	Medium	1
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2