mariadb-mytop-git

LOW
maintainer TrialnError 0 votes base mariadb-git scanned 2026-09-17 00:27:14.276658
View on AUR
Why flagged

The setuid operation in the .install script is limited to a known MariaDB PAM tool binary, which is a legitimate requirement for PAM authentication; the package builds from official project sources and shows no signs of malicious behavior.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The setuid operation in the .install script is limited to a known MariaDB PAM tool binary, which is a legitimate requirement for PAM authentication; the package builds from official project sources and shows no signs of malicious behavior.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

  • PKGBUILD:315 chmod 4755 "${pkgdir}"/usr/lib/mysql/plugin/auth_pam_tool_dir/auth_pam_tool

PKGBUILD

1 offending line(s) highlighted
1# Contributor: Lex Black <autumn-wind@web.de>
2# Contributor: João Figueiredo & chaotic-aur <islandc0der@chaotic.cx>
3# Contributor: Bartłomiej Piotrowski <bpiotrowski@archlinux.org>
4# Contributor: Christian Hesse <mail@eworm.de>
5
6# Follows the development branch for the current GA (General Availability) release
7
8pkgbase=mariadb-git
9pkgname=(
10 'mariadb-libs-git'
11 'mariadb-clients-git'
12 'mariadb-git'
13 'mariadb-mytop-git'
14 'mariadb-pam-git')
15pkgdesc='Fast SQL database server, derived from MySQL'
16_pkgver=12.3
17pkgver=12.3.3.r2.g3b78f10
18pkgrel=1
19arch=('x86_64')
20license=('GPL-2.0-only')
21url='https://mariadb.org/'
22makedepends=('git' 'boost' 'bzip2' 'cmake' 'cracklib' 'curl' 'jemalloc' 'judy' 'krb5' 'liburing'
23 'libxcrypt' 'libxml2' 'lz4' 'openssl' 'pcre2' 'systemd' 'zlib' 'zstd' 'xz')
24validpgpkeys=('177F4010FE56CA3336300305F1656F24C74CD1D8') # MariaDB Signing Key <signing-key@mariadb.org>
25source=("mariadb::git+https://github.com/MariaDB/server.git#branch=${_pkgver}?signed"
26 'git+https://github.com/codership/wsrep-lib.git'
27 'git+https://github.com/duckdb/duckdb.git'
28 'git+https://github.com/facebook/rocksdb.git'
29 'git+https://github.com/mariadb-corporation/libmarias3.git'
30 'git+https://github.com/mariadb-corporation/mariadb-columnstore-engine.git'
31 'git+https://github.com/MariaDB/mariadb-connector-c.git'
32 'git+https://github.com/wolfSSL/wolfssl.git'
33 '0001-arch-specific.patch')
34sha256sums=('SKIP'
35 'SKIP'
36 'SKIP'
37 'SKIP'
38 'SKIP'
39 'SKIP'
40 'SKIP'
41 'SKIP'
42 '9a388374ed0f04a5b576c0177cc93d35075c9d50bb422b9c09ce69f48eefb978')
43
44pkgver() {
45 cd mariadb/
46 git describe --long --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/^mariadb.//'
47}
48
49prepare() {
50 cd mariadb/
51
52 # setup git submodules
53 git config --file=.gitmodules submodule.extra/wolfssl/wolfssl.url ../wolfssl/
54 git config --file=.gitmodules submodule.libmariadb.url ../mariadb-connector-c/
55 git config --file=.gitmodules submodule.storage/columnstore/columnstore.url ../mariadb-columnstore-engine/
56 git config --file=.gitmodules submodule.storage/duckdb/third_parties/duckdb.url ../duckdb/
57 git config --file=.gitmodules submodule.storage/maria/libmarias3.url ../libmarias3/
58 git config --file=.gitmodules submodule.storage/rocksdb/rocksdb.url ../rocksdb/
59 git config --file=.gitmodules submodule.wsrep-lib.url ../wsrep-lib/
60 git submodule init
61 git -c protocol.file.allow=always submodule update
62
63 # Arch Linux specific patches:
64 # * enable PrivateTmp for a little bit more security
65 # * force preloading jemalloc for memory management
66 # * make systemd-tmpfiles create MYSQL_DATADIR
67 patch -Np1 < ../0001-arch-specific.patch
68}
69
70build() {
71 local _cmake_options=(
72 # build options
73 -DCOMPILATION_COMMENT="Arch Linux"
74 -DCMAKE_BUILD_TYPE=RelWithDebInfo
75 #-DCMAKE_BUILD_TYPE=Debug
76 #-DMYSQL_MAINTAINER_MODE=WARN
77 -Wno-dev
78
79 # file paths
80 # /etc
81 -DINSTALL_SYSCONFDIR=/etc
82 -DINSTALL_SYSCONF2DIR=/etc/my.cnf.d
83 # /run
84 -DINSTALL_RUNDIR=/run
85 -DINSTALL_UNIX_ADDRDIR=/run/mysqld/mysqld.sock
86 # /usr
87 -DCMAKE_INSTALL_PREFIX=/usr
88 # /usr/bin /usr/include
89 -DINSTALL_SCRIPTDIR=bin
90 -DINSTALL_INCLUDEDIR=include/mysql
91 # /usr/lib
92 -DINSTALL_PLUGINDIR=lib/mysql/plugin
93 -DINSTALL_SYSTEMD_UNITDIR=lib/systemd/system/
94 -DINSTALL_SYSTEMD_SYSUSERSDIR=lib/sysusers.d/
95 -DINSTALL_SYSTEMD_TMPFILESDIR=lib/tmpfiles.d/
96 # /usr/share
97 -DINSTALL_SHAREDIR=share
98 -DINSTALL_SUPPORTFILESDIR=share/mysql
99 -DINSTALL_MYSQLSHAREDIR=share/mysql
100 -DINSTALL_DOCREADMEDIR=share/doc/mariadb
101 -DINSTALL_DOCDIR=share/doc/mariadb
102 -DINSTALL_MANDIR=share/man
103 # /var
104 -DMYSQL_DATADIR=/var/lib/mysql
105
106 # default settings
107 -DDEFAULT_CHARSET=utf8mb4
108 -DDEFAULT_COLLATION=utf8mb4_unicode_ci
109
110 # /\ WARNING: This option is kind of insane... One expects that AUTO does allow the
111 # /\7\ build system to decide. Actually this is not true: Every value (ON / AUTO / OFF)
112 # /_()_\ sets different default values for the build. Let's go with the most secure,
113 # should be possible to enable at run time for all components.
114 -DENABLED_LOCAL_INFILE=OFF
115
116 # features
117 -DPLUGIN_EXAMPLE=NO
118 -DPLUGIN_FEDERATED=NO
119 -DPLUGIN_FEEDBACK=NO
120 -DWITH_EMBEDDED_SERVER=ON
121 -DWITH_EXTRA_CHARSETS=complex
122 -DWITH_JEMALLOC=ON
123 -DWITH_LIBWRAP=OFF
124 -DWITH_PCRE2=system
125 -DWITH_READLINE=ON
126 -DWITH_SSL=system
127 -DWITH_SYSTEMD=yes
128 -DWITH_UNIT_TESTS=OFF
129 -DWITH_ZLIB=system
130 )
131
132 # this uses malloc_usable_size, which is incompatible with fortification level 3
133 export CFLAGS="${CFLAGS/_FORTIFY_SOURCE=3/_FORTIFY_SOURCE=2}"
134 export CXXFLAGS="${CXXFLAGS/_FORTIFY_SOURCE=3/_FORTIFY_SOURCE=2}"
135
136 mkdir build
137 cd build
138
139 cmake ../mariadb/ "${_cmake_options[@]}"
140
141 make
142}
143
144check() {
145 cd build/mysql-test
146
147 # Takes *really* long, so disabled by default.
148 #./mtr --parallel=5 --mem --force --max-test-fail=0
149}
150
151package_mariadb-libs-git() {
152 pkgdesc='MariaDB libraries'
153 depends=('liburing' 'liburing.so'
154 'libxcrypt' 'libcrypt.so'
155 'openssl' 'libcrypto.so' 'libssl.so'
156 'pcre2' 'libpcre2-8.so'
157 'zlib' 'libz.so'
158 'zstd' 'libzstd.so')
159 optdepends=('krb5: for gssapi authentication')
160 conflicts=(mariadb-libs
161 'libmysqlclient'
162 'libmariadbclient'
163 'mariadb-connector-c')
164 provides=('libmariadbclient'
165 'mariadb-connector-c'
166 'libmariadb.so'
167 'libmariadbd.so')
168
169 cd build
170
171 for dir in libmariadb libmysqld libservices include; do
172 make -C "$dir" DESTDIR="$pkgdir" install
173 done
174
175 # remove static libraries
176 rm "${pkgdir}"/usr/lib/*.a
177
178 # remove man pages
179 rm -r "${pkgdir}"/usr/share/man
180
181 ln -s mariadb_config "$pkgdir"/usr/bin/mariadb-config
182 ln -s mariadb_config "$pkgdir"/usr/bin/mysql_config
183 install -D -m0644 "$srcdir"/mariadb/man/mariadb_config.1 "$pkgdir"/usr/share/man/man1/mariadb_config.1
184 ln -s mariadb_config.1 "$pkgdir"/usr/share/man/man1/mariadb-config.1
185 ln -s mariadb_config.1 "$pkgdir"/usr/share/man/man1/mysql_config.1
186
187 install -D -m0644 support-files/mariadb.pc "$pkgdir"/usr/share/pkgconfig/mariadb.pc
188 install -D -m0644 "$srcdir"/mariadb/support-files/mysql.m4 "$pkgdir"/usr/share/aclocal/mysql.m4
189}
190
191package_mariadb-clients-git() {
192 pkgdesc='MariaDB client tools'
193 depends=("mariadb-libs-git=${pkgver}"
194 'ncurses' 'libncursesw.so')
195 conflicts=('mariadb-clients' 'mysql-clients')
196 provides=("mysql-clients=${pkgver}")
197
198 make -C build/client DESTDIR="${pkgdir}" install
199
200 # install man pages
201 make -C build/man DESTDIR="${srcdir}"/client-man install
202 install -d -m0755 "${pkgdir}"/usr/share/man/man1/
203 for man in $(find "${pkgdir}"/usr/bin/ ! -type d); do
204 install -D -m0644 -t "${pkgdir}"/usr/share/man/man1/ "${srcdir}"/client-man/usr/share/man/man1/"$(basename "${man}")".1
205 done
206}
207
208package_mariadb-git() {
209 pkgdesc='Fast SQL database server, derived from MySQL'
210 backup=('etc/my.cnf'
211 'etc/my.cnf.d/client.cnf'
212 'etc/my.cnf.d/enable_encryption.preset'
213 'etc/my.cnf.d/mysql-clients.cnf'
214 'etc/my.cnf.d/provider_bzip2.cnf'
215 'etc/my.cnf.d/provider_lz4.cnf'
216 'etc/my.cnf.d/provider_lzma.cnf'
217 'etc/my.cnf.d/s3.cnf'
218 'etc/my.cnf.d/server.cnf'
219 'etc/my.cnf.d/spider.cnf')
220 install=mariadb.install
221 depends=("mariadb-clients-git=${pkgver}"
222 'bzip2' 'libbz2.so'
223 'coreutils'
224 'jemalloc'
225 'libxml2' 'libxml2.so'
226 'lz4' 'liblz4.so'
227 'systemd-libs' 'libsystemd.so'
228 'zstd' 'libzstd.so')
229 optdepends=('cracklib: for cracklib plugin'
230 'curl: for ha_s3 plugin'
231 'galera: for MariaDB cluster with Galera WSREP'
232 'judy: for Open Query GRAPH (OQGraph) computation engine'
233 'mariadb-pam: for PAM authentication'
234 'perl-dbd-mariadb: for mariadb-hotcopy, mariadb-convert-table-format and mariadb-setpermission'
235 'python-mysqlclient: for myrocks_hotbackup'
236 'xz: lzma provider')
237 conflicts=('mariadb' 'mysql')
238 provides=("mariadb-server=${pkgver}"
239 "mysql=${pkgver}")
240 options=('emptydirs')
241
242 cd build
243
244 make DESTDIR="$pkgdir" install
245
246 cd "$pkgdir"
247
248 # no SysV init, please!
249 rm -r etc/logrotate.d
250 rm usr/bin/rcmysql
251 rm usr/share/mysql/{binary-configure,mysql{,d_multi}.server}
252
253 # move to proper licenses directories
254 install -d usr/share/licenses/mariadb
255 mv usr/share/doc/mariadb/COPYING* usr/share/licenses/mariadb/
256
257 # move it where one might look for it
258 mv usr/share/{groonga{,-normalizer-mysql},doc/mariadb/}
259
260 # already installed to real systemd unit directory or useless
261 rm -r usr/share/mysql/systemd/
262 rm -r usr/lib/systemd/system/mariadb@bootstrap.service.d
263
264 # provided by mariadb-libs
265 rm usr/bin/{mariadb{_,-},mysql_}config
266 rm -r usr/include/
267 rm usr/share/man/man1/{mariadb,mysql}_config.1
268 rm -r usr/share/aclocal
269 rm usr/lib/lib*
270 rm -r usr/lib/pkgconfig
271 rm usr/lib/mysql/plugin/{auth_gssapi_client,caching_sha2_password,client_ed25519,dialog,mysql_clear_password,parsec,sha256_password,zstd}.so
272
273 # provided by mariadb-clients
274 for bin in $(find "${pkgdir}/../${pkgbase}-clients/usr/bin/" ! -type d); do
275 rm "${pkgdir}"/usr/bin/"$(basename "${bin}")" "${pkgdir}"/usr/share/man/man1/"$(basename "${bin}")".1
276 done
277
278 # provided by mariadb-pam
279 install -d -m0755 "${srcdir}"/mariadb-pam/usr/lib/{mysql/plugin,security}/ "${srcdir}"/mariadb-pam/etc/security/
280 mv usr/lib/mysql/plugin/auth_pam* "${srcdir}"/mariadb-pam/usr/lib/mysql/plugin/
281 mv usr/share/pam_user_map.so "${srcdir}"/mariadb-pam/usr/lib/security/
282 mv usr/share/user_map.conf "${srcdir}"/mariadb-pam/etc/security/
283
284 # provided by mariadb-mytop
285 rm usr/bin/mytop
286 rm usr/share/man/man1/mytop.1
287
288 # not needed
289 rm -r usr/{mariadb-test,sql-bench}
290 rm usr/share/man/man1/mysql-test-run.pl.1
291}
292
293package_mariadb-mytop-git() {
294 pkgdesc='Top clone for MariaDB'
295 depends=('perl'
296 'perl-dbd-mariadb'
297 'perl-term-readkey')
298 conflicts=('mytop' 'mariadb-mytop')
299 provides=("mariadb-mytop=${pkgver}")
300
301 install -D -m0755 build/scripts/mytop "${pkgdir}"/usr/bin/mytop
302 install -D -m0755 mariadb/man/mytop.1 "${pkgdir}"/usr/share/man/man1/mytop.1
303}
304
305package_mariadb-pam-git() {
306 pkgdesc='MariaDB PAM support'
307 depends=("mariadb=${pkgver}"
308 'pam' 'libpam.so')
309 conflicts=('mariadb-pam')
310 provides=("mariadb-pam=${pkgver}")
311 backup=('etc/security/user_map.conf')
312
313 mv mariadb-pam/{etc,usr}/ "${pkgdir}"/
314 # make auth_pam_tool setuid!
315 chmod 4755 "${pkgdir}"/usr/lib/mysql/plugin/auth_pam_tool_dir/auth_pam_tool
316}
317

Scan history

Scanned at (UTC)SeverityRules
2026-09-17 00:27:14 Low 2
2026-09-16 00:03:17 Low 2
2026-09-15 00:25:31 Low 2
2026-09-14 00:27:57 Low 2
2026-09-13 00:19:54 Low 2
2026-09-12 00:25:17 Low 2
2026-09-11 00:19:22 Low 2
2026-09-10 00:22:44 Low 2
2026-09-09 00:04:09 Low 2
2026-09-08 00:18:08 Low 2
2026-09-07 00:30:15 Low 2
2026-09-06 00:17:06 Low 2
2026-09-05 00:16:27 Low 2
2026-09-04 00:03:13 Low 2
2026-09-03 00:15:47 Low 2
2026-09-02 00:02:31 Low 2
2026-09-01 00:11:19 Low 2
2026-08-31 00:19:57 Low 2
2026-08-30 00:04:14 Low 2
2026-08-29 00:29:17 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion