◎ AURWatch - AUR Security Monitor
scan coverage …
Last scan …
Next scan -

mariadb-pam-git

maintainer TrialnError · 0 votes · base mariadb-git · scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged The setuid chmod 4755 on auth_pam_tool is a known, intentional requirement for MariaDB's PAM authentication plugin (the binary needs elevated privileges to read /etc/shadow); this is standard MariaDB packaging practice, not malicious. All sources are from official MariaDB/upstream GitHub repositories, and the package is building from source with no unverifiable prebuilt binaries or obfuscated payloads.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 85%): The setuid chmod 4755 on auth_pam_tool is a known, intentional requirement for MariaDB's PAM authentication plugin (the binary needs elevated privileges to read /etc/shadow); this is standard MariaDB packaging practice, not malicious. All sources are from official MariaDB/upstream GitHub repositories, and the package is building from source with no unverifiable prebuilt binaries or obfuscated payloads.

1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

  • PKGBUILD:317 chmod 4755 "${pkgdir}"/usr/lib/mysql/plugin/auth_pam_tool_dir/auth_pam_tool

PKGBUILD

1 offending line(s) highlighted
1# Contributor: Lex Black <autumn-wind@web.de>
2# Contributor: João Figueiredo & chaotic-aur <islandc0der@chaotic.cx>
3# Contributor: Bartłomiej Piotrowski <bpiotrowski@archlinux.org>
4# Contributor: Christian Hesse <mail@eworm.de>
5
6# Follows the development branch for the current GA (General Availability) release
7
8pkgbase=mariadb-git
9pkgname=(
10 'mariadb-libs-git'
11 'mariadb-clients-git'
12 'mariadb-git'
13 'mariadb-mytop-git'
14 'mariadb-pam-git')
15pkgdesc='Fast SQL database server, derived from MySQL'
16_pkgver=12.3
17pkgver=12.3.2.r283.g8da3462
18pkgrel=1
19arch=('x86_64')
20license=('GPL-2.0-only')
21url='https://mariadb.org/'
22makedepends=('git' 'boost' 'bzip2' 'cmake' 'cracklib' 'curl' 'jemalloc' 'judy' 'krb5' 'liburing'
23 'libxcrypt' 'libxml2' 'lz4' 'openssl' 'pcre2' 'systemd' 'zlib' 'zstd' 'xz')
24validpgpkeys=('177F4010FE56CA3336300305F1656F24C74CD1D8') # MariaDB Signing Key <signing-key@mariadb.org>
25source=("mariadb::git+https://github.com/MariaDB/server.git#branch=${_pkgver}?signed"
26 'git+https://github.com/MariaDB/mariadb-connector-c.git'
27 'git+https://github.com/facebook/rocksdb.git'
28 'git+https://github.com/codership/wsrep-lib.git'
29 'git+https://github.com/wolfSSL/wolfssl.git'
30 'git+https://github.com/mariadb-corporation/libmarias3.git'
31 'git+https://github.com/mariadb-corporation/mariadb-columnstore-engine.git'
32 '0001-arch-specific.patch')
33sha256sums=('SKIP'
34 'SKIP'
35 'SKIP'
36 'SKIP'
37 'SKIP'
38 'SKIP'
39 'SKIP'
40 '966d0854d4aa09dc08b8c1f0cbc65806ca09543ed9a41a3714d400cca49e0adb')
41
42pkgver() {
43 cd mariadb/
44 git describe --long --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/^mariadb.//'
45}
46
47prepare() {
48 cd mariadb/
49
50 # setup git submodules
51 git config --file=.gitmodules submodule.libmariadb.url ../mariadb-connector-c/
52 git config --file=.gitmodules submodule.storage/rocksdb/rocksdb.url ../rocksdb/
53 git config --file=.gitmodules submodule.wsrep-lib.url ../wsrep-lib/
54 git config --file=.gitmodules submodule.extra/wolfssl/wolfssl.url ../wolfssl/
55 git config --file=.gitmodules submodule.storage/maria/libmarias3.url ../libmarias3/
56 git config --file=.gitmodules submodule.storage/columnstore/columnstore.url ../mariadb-columnstore-engine/
57 git submodule init
58 git -c protocol.file.allow=always submodule update
59
60 # Arch Linux specific patches:
61 # * enable PrivateTmp for a little bit more security
62 # * force preloading jemalloc for memory management
63 # * make systemd-tmpfiles create MYSQL_DATADIR
64 patch -Np1 < ../0001-arch-specific.patch
65}
66
67build() {
68 local _cmake_options=(
69 # build options
70 -DCOMPILATION_COMMENT="Arch Linux"
71 -DCMAKE_BUILD_TYPE=RelWithDebInfo
72 #-DCMAKE_BUILD_TYPE=Debug
73 #-DMYSQL_MAINTAINER_MODE=WARN
74 -Wno-dev
75
76 # file paths
77 # /etc
78 -DINSTALL_SYSCONFDIR=/etc
79 -DINSTALL_SYSCONF2DIR=/etc/my.cnf.d
80 # /run
81 -DINSTALL_RUNDATADIR=/run/mariadb
82 -DINSTALL_UNIX_ADDRDIR=/run/mysqld/mysqld.sock
83 # /usr
84 -DCMAKE_INSTALL_PREFIX=/usr
85 # /usr/bin /usr/include
86 -DINSTALL_SCRIPTDIR=bin
87 -DINSTALL_INCLUDEDIR=include/mysql
88 # /usr/lib
89 -DINSTALL_PLUGINDIR=lib/mysql/plugin
90 -DINSTALL_SYSTEMD_UNITDIR=lib/systemd/system/
91 -DINSTALL_SYSTEMD_SYSUSERSDIR=lib/sysusers.d/
92 -DINSTALL_SYSTEMD_TMPFILESDIR=lib/tmpfiles.d/
93 # /usr/share
94 -DINSTALL_SHAREDIR=share
95 -DINSTALL_SUPPORTFILESDIR=share/mysql
96 -DINSTALL_MYSQLSHAREDIR=share/mysql
97 -DINSTALL_DOCREADMEDIR=share/doc/mariadb
98 -DINSTALL_DOCDIR=share/doc/mariadb
99 -DINSTALL_MANDIR=share/man
100 # /var
101 -DMYSQL_DATADIR=/var/lib/mysql
102
103 # default settings
104 -DDEFAULT_CHARSET=utf8mb4
105 -DDEFAULT_COLLATION=utf8mb4_unicode_ci
106
107 # /\ WARNING: This option is kind of insane... One expects that AUTO does allow the
108 # /\7\ build system to decide. Actually this is not true: Every value (ON / AUTO / OFF)
109 # /_()_\ sets different default values for the build. Let's go with the most secure,
110 # should be possible to enable at run time for all components.
111 -DENABLED_LOCAL_INFILE=OFF
112
113 # features
114 -DPLUGIN_EXAMPLE=NO
115 -DPLUGIN_FEDERATED=NO
116 -DPLUGIN_FEEDBACK=NO
117 -DWITH_EMBEDDED_SERVER=ON
118 -DWITH_EXTRA_CHARSETS=complex
119 -DWITH_JEMALLOC=ON
120 -DWITH_LIBWRAP=OFF
121 -DWITH_PCRE2=system
122 -DWITH_READLINE=ON
123 -DWITH_SSL=system
124 -DWITH_SYSTEMD=yes
125 -DWITH_UNIT_TESTS=OFF
126 -DWITH_ZLIB=system
127 )
128
129 # this uses malloc_usable_size, which is incompatible with fortification level 3
130 export CFLAGS="${CFLAGS/_FORTIFY_SOURCE=3/_FORTIFY_SOURCE=2}"
131 export CXXFLAGS="${CXXFLAGS/_FORTIFY_SOURCE=3/_FORTIFY_SOURCE=2}"
132
133 mkdir build
134 cd build
135
136 cmake ../mariadb/ "${_cmake_options[@]}"
137
138 make
139}
140
141check() {
142 cd build/mysql-test
143
144 # Takes *really* long, so disabled by default.
145 #./mtr --parallel=5 --mem --force --max-test-fail=0
146}
147
148package_mariadb-libs-git() {
149 pkgdesc='MariaDB libraries'
150 depends=('liburing' 'liburing.so'
151 'libxcrypt' 'libcrypt.so'
152 'openssl' 'libcrypto.so' 'libssl.so'
153 'pcre2' 'libpcre2-8.so'
154 'zlib' 'libz.so'
155 'zstd' 'libzstd.so')
156 optdepends=('krb5: for gssapi authentication')
157 conflicts=(mariadb-libs
158 'libmysqlclient'
159 'libmariadbclient'
160 'mariadb-connector-c')
161 provides=('libmariadbclient'
162 'mariadb-connector-c'
163 'libmariadb.so'
164 'libmariadbd.so')
165
166 cd build
167
168 for dir in libmariadb libmysqld libservices include; do
169 make -C "$dir" DESTDIR="$pkgdir" install
170 done
171
172 # remove static libraries
173 rm "${pkgdir}"/usr/lib/*.a
174
175 # remove man pages
176 rm -r "${pkgdir}"/usr/share/man
177
178 ln -s mariadb_config "$pkgdir"/usr/bin/mariadb-config
179 ln -s mariadb_config "$pkgdir"/usr/bin/mysql_config
180 install -D -m0644 "$srcdir"/mariadb/man/mariadb_config.1 "$pkgdir"/usr/share/man/man1/mariadb_config.1
181 ln -s mariadb_config.1 "$pkgdir"/usr/share/man/man1/mariadb-config.1
182 ln -s mariadb_config.1 "$pkgdir"/usr/share/man/man1/mysql_config.1
183
184 install -D -m0644 support-files/mariadb.pc "$pkgdir"/usr/share/pkgconfig/mariadb.pc
185 install -D -m0644 "$srcdir"/mariadb/support-files/mysql.m4 "$pkgdir"/usr/share/aclocal/mysql.m4
186}
187
188package_mariadb-clients-git() {
189 pkgdesc='MariaDB client tools'
190 depends=("mariadb-libs-git=${pkgver}"
191 'ncurses' 'libncursesw.so')
192 conflicts=('mariadb-clients' 'mysql-clients')
193 provides=("mysql-clients=${pkgver}")
194
195 make -C build/client DESTDIR="${pkgdir}" install
196
197 # install man pages
198 make -C build/man DESTDIR="${srcdir}"/client-man install
199 install -d -m0755 "${pkgdir}"/usr/share/man/man1/
200 for man in $(find "${pkgdir}"/usr/bin/ ! -type d); do
201 install -D -m0644 -t "${pkgdir}"/usr/share/man/man1/ "${srcdir}"/client-man/usr/share/man/man1/"$(basename "${man}")".1
202 done
203}
204
205package_mariadb-git() {
206 pkgdesc='Fast SQL database server, derived from MySQL'
207 backup=('etc/my.cnf'
208 'etc/my.cnf.d/client.cnf'
209 'etc/my.cnf.d/enable_encryption.preset'
210 'etc/my.cnf.d/mysql-clients.cnf'
211 'etc/my.cnf.d/provider_bzip2.cnf'
212 'etc/my.cnf.d/provider_lz4.cnf'
213 'etc/my.cnf.d/provider_lzma.cnf'
214 'etc/my.cnf.d/s3.cnf'
215 'etc/my.cnf.d/server.cnf'
216 'etc/my.cnf.d/spider.cnf')
217 install=mariadb.install
218 depends=("mariadb-clients-git=${pkgver}"
219 'bzip2' 'libbz2.so'
220 'coreutils'
221 'jemalloc'
222 'libxml2' 'libxml2.so'
223 'lz4' 'liblz4.so'
224 'systemd-libs' 'libsystemd.so'
225 'zstd' 'libzstd.so')
226 optdepends=('cracklib: for cracklib plugin'
227 'curl: for ha_s3 plugin'
228 'galera: for MariaDB cluster with Galera WSREP'
229 'judy: for Open Query GRAPH (OQGraph) computation engine'
230 'mariadb-pam: for PAM authentication'
231 'perl-dbd-mariadb: for mariadb-hotcopy, mariadb-convert-table-format and mariadb-setpermission'
232 'python-mysqlclient: for myrocks_hotbackup'
233 'xz: lzma provider')
234 conflicts=('mariadb' 'mysql')
235 provides=("mariadb-server=${pkgver}"
236 "mysql=${pkgver}")
237 options=('emptydirs')
238
239 cd build
240
241 make DESTDIR="$pkgdir" install
242
243 cd "$pkgdir"
244
245 # no SysV init, please!
246 rm -r etc/logrotate.d
247 rm usr/bin/rcmysql
248 rm usr/share/mysql/{binary-configure,mysql{,d_multi}.server}
249
250 # move to proper licenses directories
251 install -d usr/share/licenses/mariadb
252 mv usr/share/doc/mariadb/COPYING* usr/share/licenses/mariadb/
253
254 # move it where one might look for it
255 mv usr/share/{groonga{,-normalizer-mysql},doc/mariadb/}
256
257 # move to pam directories
258 install -d {etc,usr/lib}/security
259 mv usr/share/user_map.conf etc/security/
260 mv usr/share/pam_user_map.so usr/lib/security/
261
262 # already installed to real systemd unit directory or useless
263 rm -r usr/share/mysql/systemd/
264 rm -r usr/lib/systemd/system/mariadb@bootstrap.service.d
265
266 # provided by mariadb-libs
267 rm usr/bin/{mariadb{_,-},mysql_}config
268 rm -r usr/include/
269 rm usr/share/man/man1/{mariadb,mysql}_config.1
270 rm -r usr/share/aclocal
271 rm usr/lib/lib*
272 rm -r usr/lib/pkgconfig
273 rm usr/lib/mysql/plugin/{auth_gssapi_client,caching_sha2_password,client_ed25519,dialog,mysql_clear_password,parsec,sha256_password,zstd}.so
274
275 # provided by mariadb-clients
276 for bin in $(find "${pkgdir}/../${pkgbase}-clients/usr/bin/" ! -type d); do
277 rm "${pkgdir}"/usr/bin/"$(basename "${bin}")" "${pkgdir}"/usr/share/man/man1/"$(basename "${bin}")".1
278 done
279
280 # provided by mariadb-pam
281 install -d -m0755 "${srcdir}"/mariadb-pam/usr/lib/{mysql/plugin,security}/ "${srcdir}"/mariadb-pam/etc/security/
282 mv usr/lib/mysql/plugin/auth_pam* "${srcdir}"/mariadb-pam/usr/lib/mysql/plugin/
283 mv usr/lib/security/pam_user_map.so "${srcdir}"/mariadb-pam/usr/lib/security/
284 mv etc/security/user_map.conf "${srcdir}"/mariadb-pam/etc/security/
285
286 # provided by mariadb-mytop
287 rm usr/bin/mytop
288 rm usr/share/man/man1/mytop.1
289
290 # not needed
291 rm -r usr/{mariadb-test,sql-bench}
292 rm usr/share/man/man1/mysql-test-run.pl.1
293}
294
295package_mariadb-mytop-git() {
296 pkgdesc='Top clone for MariaDB'
297 depends=('perl'
298 'perl-dbd-mariadb'
299 'perl-term-readkey')
300 conflicts=('mytop' 'mariadb-mytop')
301 provides=("mariadb-mytop=${pkgver}")
302
303 install -D -m0755 build/scripts/mytop "${pkgdir}"/usr/bin/mytop
304 install -D -m0755 mariadb/man/mytop.1 "${pkgdir}"/usr/share/man/man1/mytop.1
305}
306
307package_mariadb-pam-git() {
308 pkgdesc='MariaDB PAM support'
309 depends=("mariadb=${pkgver}"
310 'pam' 'libpam.so')
311 conflicts=('mariadb-pam')
312 provides=("mariadb-pam=${pkgver}")
313 backup=('etc/security/user_map.conf')
314
315 mv mariadb-pam/{etc,usr}/ "${pkgdir}"/
316 # make auth_pam_tool setuid!
317 chmod 4755 "${pkgdir}"/usr/lib/mysql/plugin/auth_pam_tool_dir/auth_pam_tool
318}
319

Scan history

Scanned at (UTC)SeverityRules
2026-08-03 00:08:14 LOW 2
2026-08-02 00:16:08 LOW 2
2026-08-01 00:11:18 LOW 2
2026-07-31 00:14:10 LOW 2
2026-07-30 00:17:23 LOW 2
2026-07-29 00:25:53 LOW 2
2026-07-28 00:07:28 LOW 2
2026-07-27 00:24:32 LOW 2
2026-07-26 00:07:32 LOW 2
2026-07-25 00:13:44 LOW 2
2026-07-24 00:02:28 LOW 2
2026-07-23 00:14:47 LOW 2
2026-07-22 00:29:32 LOW 2
2026-07-21 00:24:15 LOW 2
2026-07-20 00:19:49 LOW 2
2026-07-19 00:17:08 LOW 2
2026-07-18 00:14:48 LOW 2
2026-07-17 00:06:16 LOW 2
2026-07-16 00:05:41 LOW 2
2026-07-15 00:09:25 LOW 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion