pi-hole-core
LOW
maintainer fabi
119 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package installs a sudoers file for legitimate privilege escalation required by the Pi-hole application, which is a normal part of its operation and not indicative of malicious self-update or unauthorized privilege gain.
Triggered rules
Low
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-07-25) reviewed this and agrees it is LOW (confidence 95%): The package installs a sudoers file for legitimate privilege escalation required by the Pi-hole application, which is a normal part of its operation and not indicative of malicious self-update or unauthorized privilege gain.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
Privileged / out-of-pacman install (sudoers, setuid, or self-update)
privileged_install
The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.
-
PKGBUILD:70
install -dm750 "$pkgdir"/etc/sudoers.d -
PKGBUILD:71
install -Dm440 $_pkgname-$pkgver/advanced/Templates/pihole.sudo "$pkgdir"/etc/sudoers.d/pihole
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: max.bra <max dot bra dot gtalk at gmail dot com>
2
# Maintainer: graysky <therealgraysky AT protonmail DOT com>
3
# Contributor: disprofarma <garmengol AT disprofarma DOT com DOT ar>
4
5
pkgname=pi-hole-core
6
_pkgname=pi-hole
7
pkgver=6.4.3
8
pkgrel=3
9
pkgdesc='The Pi-hole is an advertising-aware DNS/Web server. Arch adaptation for lan wide DNS server.'
10
arch=('any')
11
license=('EUPL-1.2')
12
url="https://github.com/pi-hole/pi-hole"
13
depends=('pi-hole-ftl>=6.0' 'netcat' 'logrotate' 'bind' 'sudo' 'lsof' 'inetutils' 'iproute2' 'procps-ng' 'jq' 'git')
14
makedepends=()
15
optdepends=()
16
conflicts=('pi-hole-standalone' 'pi-hole-server')
17
provides=('pi-hole-standalone' 'pi-hole-server')
18
install=$pkgname.install
19
backup=('etc/pihole/pihole.toml' 'etc/sudoers.d/pihole')
20
21
source=($pkgname-$pkgver.tar.gz::https://github.com/$_pkgname/$_pkgname/archive/refs/tags/v$pkgver.tar.gz
22
arch-core.patch
23
$_pkgname.tmpfile
24
$_pkgname-gravity.service
25
$_pkgname-gravity.timer
26
$_pkgname-logtruncate.service
27
$_pkgname-logtruncate.timer
28
mimic_basic-install.sh
29
piholeDebug.sh
30
)
31
sha256sums=('defe72687f90af45c3e735aa9bfabc01d1d75a3b3d6197e92c6216971859e57e'
32
'b78499e9600e3f31790ec82e46eaf90a0c6136e40a60c6e6c800ee4ebd2afee4'
33
'd09f9d10ebdfb6db24d4e1abff8cd09519a7b3f3878ef3974c26aa6838f74e7e'
34
'9b72d7769036f8f4bb7121968d2ae4bdba427e4b16787ce340205a5f62b45c7c'
35
'5228b4f923eab7784952a0fd6da895e7bff2f80a7f91c4a7c6350491dfdbb2e8'
36
'88e3c78bbeaf5dc1100df65202ded8207877954a96bdf1b0ab3d9990d9fa759f'
37
'ff507ce58c9492cce57e947696e1b814469fc2d856a1e303c6e68f98c62ebf46'
38
'27288535f7d5e18c73b9fe13aa0bcd78a2fd935cb2e978c70d51b0439c87844f'
39
'69a71c29dbe42ef0cbd3655fd7ce5cf04e8a77e27a5b2c3a1fcce0b544223309')
40
41
prepare() {
42
cd "$srcdir"/"$_pkgname"-"$pkgver"
43
patch -Np1 -i "$srcdir"/arch-core.patch
44
}
45
46
package() {
47
cd "$srcdir"
48
install -Dm755 $_pkgname-$pkgver/pihole "$pkgdir"/usr/bin/pihole
49
50
install -dm755 "$pkgdir"/opt/pihole
51
install -Dm755 $_pkgname-$pkgver/gravity.sh "$pkgdir"/opt/pihole/gravity.sh
52
53
install -Dm755 $_pkgname-$pkgver/advanced/Scripts/api.sh "$pkgdir"/opt/pihole/api.sh
54
install -Dm644 $_pkgname-$pkgver/advanced/Scripts/COL_TABLE "$pkgdir"/opt/pihole/COL_TABLE
55
install -Dm755 $_pkgname-$pkgver/advanced/Scripts/list.sh "$pkgdir"/opt/pihole/list.sh
56
install -Dm755 $_pkgname-$pkgver/advanced/Scripts/piholeLogFlush.sh "$pkgdir"/opt/pihole/piholeLogFlush.sh
57
install -Dm755 $_pkgname-$pkgver/advanced/Scripts/query.sh "$pkgdir"/opt/pihole/query.sh
58
install -Dm755 $_pkgname-$pkgver/advanced/Scripts/updatecheck.sh "$pkgdir"/opt/pihole/updatecheck.sh
59
install -Dm755 $_pkgname-$pkgver/advanced/Scripts/utils.sh "$pkgdir"/opt/pihole/utils.sh
60
install -Dm755 $_pkgname-$pkgver/advanced/Scripts/version.sh "$pkgdir"/opt/pihole/version.sh
61
62
install -Dm644 $_pkgname-$pkgver/advanced/Templates/gravity.db.sql "$pkgdir"/opt/pihole/gravity.db.sql
63
install -Dm644 $_pkgname-$pkgver/advanced/Templates/gravity_copy.sql "$pkgdir"/opt/pihole/gravity_copy.sql
64
65
install -Dm755 piholeDebug.sh "$pkgdir"/opt/pihole/piholeDebug.sh
66
install -Dm755 mimic_basic-install.sh "$pkgdir"/opt/pihole/basic-install.sh
67
68
cp -dpr --no-preserve=ownership $_pkgname-$pkgver/advanced/Scripts/database_migration "$pkgdir"/opt/pihole/
69
70
install -dm750 "$pkgdir"/etc/sudoers.d
71
install -Dm440 $_pkgname-$pkgver/advanced/Templates/pihole.sudo "$pkgdir"/etc/sudoers.d/pihole
72
73
install -Dm644 pi-hole.tmpfile "$pkgdir"/usr/lib/tmpfiles.d/pi-hole.conf
74
75
install -Dm644 "$_pkgname-gravity.timer" "$pkgdir/usr/lib/systemd/system/$_pkgname-gravity.timer"
76
install -Dm644 "$_pkgname-gravity.service" $pkgdir/usr/lib/systemd/system/$_pkgname-gravity.service
77
install -Dm644 "$_pkgname-logtruncate.timer" "$pkgdir/usr/lib/systemd/system/$_pkgname-logtruncate.timer"
78
install -Dm644 "$_pkgname-logtruncate.service" $pkgdir/usr/lib/systemd/system/$_pkgname-logtruncate.service
79
install -dm755 "$pkgdir/usr/lib/systemd/system/multi-user.target.wants"
80
ln -s ../$_pkgname-gravity.timer "$pkgdir/usr/lib/systemd/system/multi-user.target.wants/$_pkgname-gravity.timer"
81
ln -s ../$_pkgname-logtruncate.timer "$pkgdir/usr/lib/systemd/system/multi-user.target.wants/$_pkgname-logtruncate.timer"
82
83
install -dm755 "$pkgdir"/etc/pihole
84
install -Dm644 $_pkgname-$pkgver/advanced/Templates/logrotate "$pkgdir"/etc/pihole/logrotate
85
86
install -dm755 "$pkgdir"/usr/share/licenses/pihole
87
install -Dm644 ${pkgname%-*}-$pkgver/LICENSE "$pkgdir"/usr/share/licenses/pihole/Pi-hole
88
}
89
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |