mariadb-pam-git

LOW
maintainer TrialnError 0 votes base mariadb-git scanned 2026-11-01 00:21:48.120785
View on AUR
Why flagged

The flagged setuid operation is on a known MariaDB authentication tool within the package's legitimate scope, not a self-update or unauthorized privilege escalation.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The flagged setuid operation is on a known MariaDB authentication tool within the package's legitimate scope, not a self-update or unauthorized privilege escalation.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

  • PKGBUILD:325 chmod 4755 "${pkgdir}"/usr/lib/mysql/plugin/auth_pam_tool_dir/auth_pam_tool

PKGBUILD

1 offending line(s) highlighted
1# Contributor: Lex Black <autumn-wind@web.de>
2# Contributor: João Figueiredo & chaotic-aur <islandc0der@chaotic.cx>
3# Contributor: Bartłomiej Piotrowski <bpiotrowski@archlinux.org>
4# Contributor: Christian Hesse <mail@eworm.de>
5
6# Follows the development branch for the current GA (General Availability) release
7
8pkgbase=mariadb-git
9pkgname=(
10 'mariadb-libs-git'
11 'mariadb-clients-git'
12 'mariadb-git'
13 'mariadb-mytop-git'
14 'mariadb-pam-git')
15pkgdesc='Fast SQL database server, derived from MySQL'
16_pkgver=13.0
17pkgver=13.0.2.r0.g620a4b5
18pkgrel=1
19arch=('x86_64')
20license=('GPL-2.0-only')
21url='https://mariadb.org/'
22makedepends=('git' 'boost' 'bzip2' 'cmake' 'cracklib' 'curl' 'jemalloc' 'judy' 'krb5' 'liburing'
23 'libxcrypt' 'libxml2' 'lz4' 'openssl' 'pcre2' 'systemd' 'zlib' 'zstd' 'xz')
24validpgpkeys=('177F4010FE56CA3336300305F1656F24C74CD1D8') # MariaDB Signing Key <signing-key@mariadb.org>
25source=("mariadb::git+https://github.com/MariaDB/server.git?signed#branch=${_pkgver}"
26 'git+https://github.com/codership/wsrep-lib.git'
27 'git+https://github.com/duckdb/duckdb.git'
28 'git+https://github.com/facebook/rocksdb.git'
29 'git+https://github.com/mariadb-corporation/libmarias3.git'
30 'git+https://github.com/mariadb-corporation/mariadb-columnstore-engine.git'
31 'git+https://github.com/MariaDB/mariadb-connector-c.git'
32 'git+https://github.com/wolfSSL/wolfssl.git'
33 '0001-arch-specific.patch'
34 'mariadb-Environment-jemalloc.conf'
35 'mariadb-PrivateTmp.conf')
36sha256sums=('SKIP'
37 'SKIP'
38 'SKIP'
39 'SKIP'
40 'SKIP'
41 'SKIP'
42 'SKIP'
43 'SKIP'
44 '0420cd146f3bb50801e0642d1f8d10a138cc5f4c3113e09fd82ab1fc67b6f3de'
45 '8ca7ed2d3b2d91a54f781ec9dbf8e9b8941c00686d2a3f9ece0adb9c4fb68009'
46 'b3df8d27b443d4d6ae40f8c0544ee765e618b56bed801e14433f0da0f774a6f2')
47
48pkgver() {
49 cd mariadb/
50 git describe --long --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/^mariadb.//'
51}
52
53prepare() {
54 cd mariadb/
55
56 # setup git submodules
57 git config --file=.gitmodules submodule.extra/wolfssl/wolfssl.url ../wolfssl/
58 git config --file=.gitmodules submodule.libmariadb.url ../mariadb-connector-c/
59 git config --file=.gitmodules submodule.storage/columnstore/columnstore.url ../mariadb-columnstore-engine/
60 git config --file=.gitmodules submodule.storage/duckdb/third_parties/duckdb.url ../duckdb/
61 git config --file=.gitmodules submodule.storage/maria/libmarias3.url ../libmarias3/
62 git config --file=.gitmodules submodule.storage/rocksdb/rocksdb.url ../rocksdb/
63 git config --file=.gitmodules submodule.wsrep-lib.url ../wsrep-lib/
64 git submodule init
65 git -c protocol.file.allow=always submodule update
66
67 # Arch Linux specific patches:
68 # * enable PrivateTmp for a little bit more security
69 # * force preloading jemalloc for memory management
70 # * make systemd-tmpfiles create MYSQL_DATADIR
71 patch -Np1 < ../0001-arch-specific.patch
72}
73
74build() {
75 local _cmake_options=(
76 # build options
77 -DCOMPILATION_COMMENT="Arch Linux"
78 -DCMAKE_BUILD_TYPE=RelWithDebInfo
79 #-DCMAKE_BUILD_TYPE=Debug
80 #-DMYSQL_MAINTAINER_MODE=WARN
81 -Wno-dev
82
83 # file paths
84 # /etc
85 -DINSTALL_SYSCONFDIR=/etc
86 -DINSTALL_SYSCONF2DIR=/etc/my.cnf.d
87 # /run
88 -DINSTALL_RUNDIR=/run
89 -DINSTALL_UNIX_ADDRDIR=/run/mysqld/mysqld.sock
90 # /usr
91 -DCMAKE_INSTALL_PREFIX=/usr
92 # /usr/bin /usr/include
93 -DINSTALL_SCRIPTDIR=bin
94 -DINSTALL_INCLUDEDIR=include/mysql
95 # /usr/lib
96 -DINSTALL_PLUGINDIR=lib/mysql/plugin
97 -DINSTALL_SYSTEMD_UNITDIR=lib/systemd/system/
98 -DINSTALL_SYSTEMD_SYSUSERSDIR=lib/sysusers.d/
99 -DINSTALL_SYSTEMD_TMPFILESDIR=lib/tmpfiles.d/
100 # /usr/share
101 -DINSTALL_SHAREDIR=share
102 -DINSTALL_SUPPORTFILESDIR=share/mysql
103 -DINSTALL_MYSQLSHAREDIR=share/mysql
104 -DINSTALL_DOCREADMEDIR=share/doc/mariadb
105 -DINSTALL_DOCDIR=share/doc/mariadb
106 -DINSTALL_MANDIR=share/man
107 # /var
108 -DMYSQL_DATADIR=/var/lib/mysql
109
110 # default settings
111 -DDEFAULT_CHARSET=utf8mb4
112 -DDEFAULT_COLLATION=utf8mb4_unicode_ci
113
114 # /\ WARNING: This option is kind of insane... One expects that AUTO does allow the
115 # /\7\ build system to decide. Actually this is not true: Every value (ON / AUTO / OFF)
116 # /_()_\ sets different default values for the build. Let's go with the most secure,
117 # should be possible to enable at run time for all components.
118 -DENABLED_LOCAL_INFILE=OFF
119
120 # features
121 -DPLUGIN_EXAMPLE=NO
122 -DPLUGIN_FEDERATED=NO
123 -DPLUGIN_FEEDBACK=NO
124 -DWITH_EMBEDDED_SERVER=ON
125 -DWITH_EXTRA_CHARSETS=complex
126 -DWITH_JEMALLOC=ON
127 -DWITH_LIBWRAP=OFF
128 -DWITH_PCRE2=system
129 -DWITH_READLINE=ON
130 -DWITH_SSL=system
131 -DWITH_SYSTEMD=yes
132 -DWITH_UNIT_TESTS=OFF
133 -DWITH_ZLIB=system
134 )
135
136 # this uses malloc_usable_size, which is incompatible with fortification level 3
137 export CFLAGS="${CFLAGS/_FORTIFY_SOURCE=3/_FORTIFY_SOURCE=2}"
138 export CXXFLAGS="${CXXFLAGS/_FORTIFY_SOURCE=3/_FORTIFY_SOURCE=2}"
139
140 mkdir build
141 cd build
142
143 cmake ../mariadb/ "${_cmake_options[@]}"
144
145 make
146}
147
148check() {
149 cd build/mysql-test
150
151 # Takes *really* long, so disabled by default.
152 #./mtr --parallel=5 --mem --force --max-test-fail=0
153}
154
155package_mariadb-libs-git() {
156 pkgdesc='MariaDB libraries'
157 depends=('liburing' 'liburing.so'
158 'libxcrypt' 'libcrypt.so'
159 'openssl' 'libcrypto.so' 'libssl.so'
160 'pcre2' 'libpcre2-8.so'
161 'zlib' 'libz.so'
162 'zstd' 'libzstd.so')
163 optdepends=('krb5: for gssapi authentication')
164 conflicts=(mariadb-libs
165 'libmysqlclient'
166 'libmariadbclient'
167 'mariadb-connector-c')
168 provides=('libmariadbclient'
169 'mariadb-connector-c'
170 'libmariadb.so'
171 'libmariadbd.so')
172
173 cd build
174
175 for dir in libmariadb libmysqld libservices include; do
176 make -C "${dir}" DESTDIR="${pkgdir}" install
177 done
178
179 # remove static libraries
180 rm "${pkgdir}"/usr/lib/*.a
181
182 # remove man pages
183 rm -r "${pkgdir}"/usr/share/man
184
185 ln -s mariadb_config "${pkgdir}"/usr/bin/mariadb-config
186 ln -s mariadb_config "${pkgdir}"/usr/bin/mysql_config
187 install -D -m0644 "${srcdir}"/mariadb/man/mariadb_config.1 "${pkgdir}"/usr/share/man/man1/mariadb_config.1
188 ln -s mariadb_config.1 "${pkgdir}"/usr/share/man/man1/mariadb-config.1
189 ln -s mariadb_config.1 "${pkgdir}"/usr/share/man/man1/mysql_config.1
190
191 install -D -m0644 support-files/mariadb.pc "${pkgdir}"/usr/share/pkgconfig/mariadb.pc
192 install -D -m0644 "${srcdir}"/mariadb/support-files/mysql.m4 "${pkgdir}"/usr/share/aclocal/mysql.m4
193}
194
195package_mariadb-clients-git() {
196 pkgdesc='MariaDB client tools'
197 depends=("mariadb-libs-git=${pkgver}"
198 'ncurses' 'libncursesw.so')
199 conflicts=('mariadb-clients' 'mysql-clients')
200 provides=("mysql-clients=${pkgver}")
201
202 make -C build/client DESTDIR="${pkgdir}" install
203
204 # install man pages
205 make -C build/man DESTDIR="${srcdir}"/client-man install
206 install -d -m0755 "${pkgdir}"/usr/share/man/man1/
207 for man in $(find "${pkgdir}"/usr/bin/ ! -type d); do
208 install -D -m0644 -t "${pkgdir}"/usr/share/man/man1/ "${srcdir}"/client-man/usr/share/man/man1/"$(basename "${man}")".1
209 done
210}
211
212package_mariadb-git() {
213 pkgdesc='Fast SQL database server, derived from MySQL'
214 backup=('etc/my.cnf'
215 'etc/my.cnf.d/client.cnf'
216 'etc/my.cnf.d/enable_encryption.preset'
217 'etc/my.cnf.d/mysql-clients.cnf'
218 'etc/my.cnf.d/provider_bzip2.cnf'
219 'etc/my.cnf.d/provider_lz4.cnf'
220 'etc/my.cnf.d/provider_lzma.cnf'
221 'etc/my.cnf.d/s3.cnf'
222 'etc/my.cnf.d/server.cnf'
223 'etc/my.cnf.d/spider.cnf')
224 install=mariadb.install
225 depends=("mariadb-clients-git=${pkgver}"
226 'bzip2' 'libbz2.so'
227 'coreutils'
228 'jemalloc'
229 'libxml2' 'libxml2.so'
230 'lz4' 'liblz4.so'
231 'systemd-libs' 'libsystemd.so'
232 'zstd' 'libzstd.so')
233 optdepends=('cracklib: for cracklib plugin'
234 'curl: for ha_s3 plugin'
235 'galera: for MariaDB cluster with Galera WSREP'
236 'judy: for Open Query GRAPH (OQGraph) computation engine'
237 'mariadb-pam: for PAM authentication'
238 'perl-dbd-mariadb: for mariadb-hotcopy, mariadb-convert-table-format and mariadb-setpermission'
239 'python-mysqlclient: for myrocks_hotbackup'
240 'xz: lzma provider')
241 conflicts=('mariadb' 'mysql')
242 provides=("mariadb-server=${pkgver}"
243 "mysql=${pkgver}")
244 options=('emptydirs')
245
246 cd build
247
248 make DESTDIR="${pkgdir}" install
249
250 # service overrides for jemalloc & private /tmp
251 install -D -m0644 ../mariadb-Environment-jemalloc.conf "${pkgdir}"/usr/lib/systemd/system/mariadb.service.d/Environment-jemalloc.conf
252 install -D -m0644 ../mariadb-Environment-jemalloc.conf "${pkgdir}"/usr/lib/systemd/system/mariadb@.service.d/Environment-jemalloc.conf
253 install -D -m0644 ../mariadb-PrivateTmp.conf "${pkgdir}"/usr/lib/systemd/system/mariadb.service.d/PrivateTmp.conf
254 install -D -m0644 ../mariadb-PrivateTmp.conf "${pkgdir}"/usr/lib/systemd/system/mariadb@.service.d/PrivateTmp.conf
255
256 cd "${pkgdir}"
257
258 # no SysV init, please!
259 rm -r etc/logrotate.d
260 rm usr/bin/rcmysql
261 rm usr/share/mysql/{binary-configure,mysql{,d_multi}.server}
262
263 # move to proper licenses directories
264 install -d usr/share/licenses/mariadb
265 mv usr/share/doc/mariadb/COPYING* usr/share/licenses/mariadb/
266
267 # move it where one might look for it
268 mv usr/share/{groonga{,-normalizer-mysql},doc/mariadb/}
269
270 # already installed to real systemd unit directory or useless
271 rm -r usr/share/mysql/systemd/
272 rm -r usr/lib/systemd/system/mariadb@bootstrap.service.d
273
274 # provided by mariadb-libs
275 rm usr/bin/{mariadb{_,-},mysql_}config
276 rm -r usr/include/
277 rm usr/share/man/man1/{mariadb,mysql}_config.1
278 rm -r usr/share/aclocal
279 rm usr/lib/lib*
280 rm -r usr/lib/pkgconfig
281 rm usr/lib/mysql/plugin/{auth_gssapi_client,caching_sha2_password,client_ed25519,dialog,mysql_clear_password,parsec,sha256_password,zstd}.so
282
283 # provided by mariadb-clients
284 for bin in $(find "${pkgdir}/../${pkgbase}-clients/usr/bin/" ! -type d); do
285 rm "${pkgdir}"/usr/bin/"$(basename "${bin}")" "${pkgdir}"/usr/share/man/man1/"$(basename "${bin}")".1
286 done
287
288 # provided by mariadb-pam
289 install -d -m0755 "${srcdir}"/mariadb-pam/usr/lib/{mysql/plugin,security}/ "${srcdir}"/mariadb-pam/etc/security/
290 mv usr/lib/mysql/plugin/auth_pam* "${srcdir}"/mariadb-pam/usr/lib/mysql/plugin/
291 mv usr/share/pam_user_map.so "${srcdir}"/mariadb-pam/usr/lib/security/
292 mv usr/share/user_map.conf "${srcdir}"/mariadb-pam/etc/security/
293
294 # provided by mariadb-mytop
295 rm usr/bin/mytop
296 rm usr/share/man/man1/mytop.1
297
298 # not needed
299 rm -r usr/{mariadb-test,sql-bench}
300 rm usr/share/man/man1/mysql-test-run.pl.1
301}
302
303package_mariadb-mytop-git() {
304 pkgdesc='Top clone for MariaDB'
305 depends=('perl'
306 'perl-dbd-mariadb'
307 'perl-term-readkey')
308 conflicts=('mytop' 'mariadb-mytop')
309 provides=("mariadb-mytop=${pkgver}")
310
311 install -D -m0755 build/scripts/mytop "${pkgdir}"/usr/bin/mytop
312 install -D -m0755 mariadb/man/mytop.1 "${pkgdir}"/usr/share/man/man1/mytop.1
313}
314
315package_mariadb-pam-git() {
316 pkgdesc='MariaDB PAM support'
317 depends=("mariadb=${pkgver}"
318 'pam' 'libpam.so')
319 conflicts=('mariadb-pam')
320 provides=("mariadb-pam=${pkgver}")
321 backup=('etc/security/user_map.conf')
322
323 mv mariadb-pam/{etc,usr}/ "${pkgdir}"/
324 # make auth_pam_tool setuid!
325 chmod 4755 "${pkgdir}"/usr/lib/mysql/plugin/auth_pam_tool_dir/auth_pam_tool
326}
327

Scan history

Scanned at (UTC)SeverityRules
2026-11-01 00:21:48 Low 2
2026-10-31 00:07:41 Low 2
2026-10-30 00:29:30 Low 2
2026-10-29 00:13:55 Low 2
2026-10-28 00:06:54 Low 2
2026-10-27 00:23:28 Low 2
2026-10-26 00:12:40 Low 2
2026-10-25 00:20:48 Low 2
2026-10-24 00:14:55 Low 2
2026-10-23 00:02:19 Low 2
2026-10-22 00:13:10 Low 2
2026-10-21 00:12:50 Low 2
2026-10-20 00:10:31 Low 2
2026-10-19 00:03:55 Low 2
2026-10-18 00:06:55 Low 2
2026-10-17 00:21:55 Low 2
2026-10-16 00:12:47 Low 2
2026-10-15 00:28:05 Low 2
2026-10-14 00:06:47 Low 2
2026-10-13 00:23:45 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion