pi-hole-core

maintainer fabi · 119 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package installs a sudoers file for legitimate privilege escalation required by the Pi-hole application, which is a normal part of its operation and not indicative of malicious self-update or unauthorized privilege gain.

Triggered rules

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-07-25) reviewed this and agrees it is LOW (confidence 95%): The package installs a sudoers file for legitimate privilege escalation required by the Pi-hole application, which is a normal part of its operation and not indicative of malicious self-update or unauthorized privilege gain.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

PKGBUILD:70 install -dm750 "$pkgdir"/etc/sudoers.d
PKGBUILD:71 install -Dm440 $_pkgname-$pkgver/advanced/Templates/pihole.sudo "$pkgdir"/etc/sudoers.d/pihole

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer:  max.bra <max dot bra dot gtalk at gmail dot com>
    
      2# Maintainer:  graysky <therealgraysky AT protonmail DOT com>
    
      3# Contributor: disprofarma <garmengol AT disprofarma DOT com DOT ar>
    
      4
    
      5pkgname=pi-hole-core
    
      6_pkgname=pi-hole
    
      7pkgver=6.4.3
    
      8pkgrel=3
    
      9pkgdesc='The Pi-hole is an advertising-aware DNS/Web server. Arch adaptation for lan wide DNS server.'
    
      10arch=('any')
    
      11license=('EUPL-1.2')
    
      12url="https://github.com/pi-hole/pi-hole"
    
      13depends=('pi-hole-ftl>=6.0' 'netcat' 'logrotate' 'bind' 'sudo' 'lsof' 'inetutils' 'iproute2' 'procps-ng' 'jq' 'git')
    
      14makedepends=()
    
      15optdepends=()
    
      16conflicts=('pi-hole-standalone' 'pi-hole-server')
    
      17provides=('pi-hole-standalone' 'pi-hole-server')
    
      18install=$pkgname.install
    
      19backup=('etc/pihole/pihole.toml' 'etc/sudoers.d/pihole')
    
      20
    
      21source=($pkgname-$pkgver.tar.gz::https://github.com/$_pkgname/$_pkgname/archive/refs/tags/v$pkgver.tar.gz
    
      22        arch-core.patch
    
      23	    $_pkgname.tmpfile
    
      24	    $_pkgname-gravity.service
    
      25	    $_pkgname-gravity.timer
    
      26	    $_pkgname-logtruncate.service
    
      27	    $_pkgname-logtruncate.timer
    
      28	    mimic_basic-install.sh
    
      29	    piholeDebug.sh
    
      30)
    
      31sha256sums=('defe72687f90af45c3e735aa9bfabc01d1d75a3b3d6197e92c6216971859e57e'
    
      32            'b78499e9600e3f31790ec82e46eaf90a0c6136e40a60c6e6c800ee4ebd2afee4'
    
      33            'd09f9d10ebdfb6db24d4e1abff8cd09519a7b3f3878ef3974c26aa6838f74e7e'
    
      34            '9b72d7769036f8f4bb7121968d2ae4bdba427e4b16787ce340205a5f62b45c7c'
    
      35            '5228b4f923eab7784952a0fd6da895e7bff2f80a7f91c4a7c6350491dfdbb2e8'
    
      36            '88e3c78bbeaf5dc1100df65202ded8207877954a96bdf1b0ab3d9990d9fa759f'
    
      37            'ff507ce58c9492cce57e947696e1b814469fc2d856a1e303c6e68f98c62ebf46'
    
      38            '27288535f7d5e18c73b9fe13aa0bcd78a2fd935cb2e978c70d51b0439c87844f'
    
      39            '69a71c29dbe42ef0cbd3655fd7ce5cf04e8a77e27a5b2c3a1fcce0b544223309')
    
      40
    
      41prepare() {
    
      42  cd "$srcdir"/"$_pkgname"-"$pkgver"
    
      43  patch -Np1 -i "$srcdir"/arch-core.patch
    
      44}
    
      45
    
      46package() {
    
      47  cd "$srcdir"
    
      48  install -Dm755 $_pkgname-$pkgver/pihole "$pkgdir"/usr/bin/pihole
    
      49
    
      50  install -dm755 "$pkgdir"/opt/pihole
    
      51  install -Dm755 $_pkgname-$pkgver/gravity.sh "$pkgdir"/opt/pihole/gravity.sh
    
      52
    
      53  install -Dm755 $_pkgname-$pkgver/advanced/Scripts/api.sh "$pkgdir"/opt/pihole/api.sh
    
      54  install -Dm644 $_pkgname-$pkgver/advanced/Scripts/COL_TABLE "$pkgdir"/opt/pihole/COL_TABLE
    
      55  install -Dm755 $_pkgname-$pkgver/advanced/Scripts/list.sh "$pkgdir"/opt/pihole/list.sh
    
      56  install -Dm755 $_pkgname-$pkgver/advanced/Scripts/piholeLogFlush.sh "$pkgdir"/opt/pihole/piholeLogFlush.sh
    
      57  install -Dm755 $_pkgname-$pkgver/advanced/Scripts/query.sh "$pkgdir"/opt/pihole/query.sh
    
      58  install -Dm755 $_pkgname-$pkgver/advanced/Scripts/updatecheck.sh "$pkgdir"/opt/pihole/updatecheck.sh
    
      59  install -Dm755 $_pkgname-$pkgver/advanced/Scripts/utils.sh "$pkgdir"/opt/pihole/utils.sh
    
      60  install -Dm755 $_pkgname-$pkgver/advanced/Scripts/version.sh "$pkgdir"/opt/pihole/version.sh
    
      61
    
      62  install -Dm644 $_pkgname-$pkgver/advanced/Templates/gravity.db.sql "$pkgdir"/opt/pihole/gravity.db.sql
    
      63  install -Dm644 $_pkgname-$pkgver/advanced/Templates/gravity_copy.sql "$pkgdir"/opt/pihole/gravity_copy.sql
    
      64
    
      65  install -Dm755 piholeDebug.sh "$pkgdir"/opt/pihole/piholeDebug.sh
    
      66  install -Dm755 mimic_basic-install.sh "$pkgdir"/opt/pihole/basic-install.sh
    
      67
    
      68  cp -dpr --no-preserve=ownership $_pkgname-$pkgver/advanced/Scripts/database_migration "$pkgdir"/opt/pihole/
    
      69
    
      70  install -dm750 "$pkgdir"/etc/sudoers.d
    
      71  install -Dm440 $_pkgname-$pkgver/advanced/Templates/pihole.sudo "$pkgdir"/etc/sudoers.d/pihole
    
      72
    
      73  install -Dm644 pi-hole.tmpfile "$pkgdir"/usr/lib/tmpfiles.d/pi-hole.conf
    
      74
    
      75  install -Dm644 "$_pkgname-gravity.timer" "$pkgdir/usr/lib/systemd/system/$_pkgname-gravity.timer"
    
      76  install -Dm644 "$_pkgname-gravity.service" $pkgdir/usr/lib/systemd/system/$_pkgname-gravity.service
    
      77  install -Dm644 "$_pkgname-logtruncate.timer" "$pkgdir/usr/lib/systemd/system/$_pkgname-logtruncate.timer"
    
      78  install -Dm644 "$_pkgname-logtruncate.service" $pkgdir/usr/lib/systemd/system/$_pkgname-logtruncate.service
    
      79  install -dm755 "$pkgdir/usr/lib/systemd/system/multi-user.target.wants"
    
      80  ln -s ../$_pkgname-gravity.timer "$pkgdir/usr/lib/systemd/system/multi-user.target.wants/$_pkgname-gravity.timer"
    
      81  ln -s ../$_pkgname-logtruncate.timer "$pkgdir/usr/lib/systemd/system/multi-user.target.wants/$_pkgname-logtruncate.timer"
    
      82
    
      83  install -dm755 "$pkgdir"/etc/pihole
    
      84  install -Dm644 $_pkgname-$pkgver/advanced/Templates/logrotate "$pkgdir"/etc/pihole/logrotate
    
      85
    
      86  install -dm755 "$pkgdir"/usr/share/licenses/pihole
    
      87  install -Dm644 ${pkgname%-*}-$pkgver/LICENSE "$pkgdir"/usr/share/licenses/pihole/Pi-hole
    
      88}
    
      89

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2