qemu-block-iscsi-git
maintainer FredBezies
· 31 votes
· base
qemu-git
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The setuid permission on qemu-bridge-helper is a legitimate requirement for network functionality in QEMU and is a known, documented practice; it does not represent malicious or unexpected privileged execution.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The setuid permission on qemu-bridge-helper is a legitimate requirement for network functionality in QEMU and is a known, documented practice; it does not represent malicious or unexpected privileged execution.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
Privileged / out-of-pacman install (sudoers, setuid, or self-update)
privileged_install
The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.
-
PKGBUILD:277
chmod u+s qemu/qemu-bridge-helper
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Frederic Bezies <fredbezies@gmail.com>
2
# Contributor: ajs124 < aur at ajs124 dot de>
3
# Contributor: Devin Cofer <ranguvar{AT]archlinux[DOT}us>
4
# Contributor: Tobias Powalowski <tpowa@archlinux.org>
5
# Contributor: David Runge <dvzrv@archlinux.org>
6
# Contributor: Sébastien "Seblu" Luttringer <seblu@seblu.net>
7
8
pkgbase=qemu-git
9
_gitname=qemu
10
pkgname=(
11
qemu-git
12
qemu-headless-git
13
qemu-arch-extra-git
14
qemu-headless-arch-extra-git
15
qemu-block-iscsi-git
16
qemu-guest-agent-git
17
)
18
pkgdesc="A generic and open source machine emulator and virtualizer. Git version."
19
pkgver=11.1.0.rc0.r19.g5ef0ecc594
20
pkgrel=1
21
epoch=28
22
arch=(i686 x86_64)
23
license=(GPL-2.0-or-later LGPL-2.1-or-later)
24
url="https://wiki.qemu.org/"
25
# TODO: consider providing rdma-core
26
# TODO: consider providing lzfse
27
makedepends=(
28
alsa-lib
29
brltty
30
bzip2
31
cairo
32
capstone
33
curl
34
cdrtools
35
dtc
36
fuse3
37
gcc-libs
38
gdk-pixbuf2
39
git
40
glib2
41
gnutls
42
gtk3
43
jack
44
libaio
45
libbpf
46
libcacard
47
libcap-ng
48
libepoxy
49
libiscsi
50
libnfs
51
libpng
52
libpulse
53
libsasl
54
libseccomp
55
libslirp
56
libssh
57
liburing
58
libusb
59
libx11
60
libxkbcommon
61
lzo
62
mesa
63
meson
64
ncurses
65
ndctl
66
numactl
67
pam
68
pixman
69
python
70
python-sphinx
71
python-sphinx_rtd_theme
72
sdl2
73
sdl2_image
74
seabios
75
snappy
76
spice-protocol
77
spice
78
systemd
79
usbredir
80
vde2
81
virglrenderer
82
vte3 libvte-2.91.so
83
xfsprogs
84
zlib
85
zstd
86
)
87
options=(!debug !lto)
88
source=(git+https://gitlab.com/qemu-project/qemu.git
89
qemu-guest-agent.service
90
65-kvm.rules)
91
sha256sums=('SKIP'
92
'c39bcde4a09165e64419fd2033b3532378bba84d509d39e2d51694d44c1f8d88'
93
'a66f0e791b16b03b91049aac61a25950d93e962e1b2ba64a38c6ad7f609b532c')
94
95
case $CARCH in
96
i?86) _corearch=i386 ;;
97
x86_64) _corearch=x86_64 ;;
98
esac
99
100
pkgver() {
101
cd "${srcdir}/${_gitname}"
102
git describe --long --tags | sed 's/\([^-]*-g\)/r\1/;s/-/./g' | cut -c2-47
103
}
104
105
prepare() {
106
cd "${srcdir}/${_gitname}"
107
mkdir build-{full,headless}
108
mkdir -p extra-arch-{full,headless}/usr/{bin,share/qemu}
109
}
110
111
build() {
112
_build full
113
114
_build headless \
115
--audio-drv-list= \
116
--disable-gtk \
117
--disable-vte \
118
--disable-brlapi \
119
--disable-opengl \
120
--disable-dbus-display \
121
--disable-virglrenderer \
122
--disable-alsa \
123
--disable-jack \
124
--disable-oss \
125
--disable-pa \
126
--disable-sdl
127
}
128
129
_build() (
130
131
cd ${srcdir}/${_gitname}/build-$1
132
133
../configure \
134
--prefix=/usr \
135
--sysconfdir=/etc \
136
--localstatedir=/var \
137
--libexecdir=/usr/lib/qemu \
138
--smbd=/usr/bin/smbd \
139
--enable-modules \
140
--enable-sdl \
141
--disable-werror #\
142
#"${@:2}"
143
144
ninja
145
)
146
147
package_qemu-git() {
148
pkgdesc="QEMU Git version."
149
depends=(
150
alsa-lib libasound.so
151
bzip2 libbz2.so
152
cairo
153
capstone
154
curl libcurl.so
155
dtc
156
fuse3
157
gcc-libs
158
gdk-pixbuf2 libgdk_pixbuf-2.0.so
159
glib2 libgio-2.0.so libglib-2.0.so libgmodule-2.0.so libgobject-2.0.so
160
gnutls
161
gtk3 libgdk-3.so libgtk-3.so
162
jack libjack.so
163
libaio
164
libbpf libbpf.so
165
libcacard
166
libcap-ng libcap-ng.so
167
libepoxy
168
libjpeg libjpeg.so
169
libnfs
170
libpng
171
libpulse libpulse.so
172
libsasl
173
libseccomp libseccomp.so
174
libslirp libslirp.so
175
libssh libssh.so
176
libusb libusb-1.0.so
177
liburing liburing.so
178
libx11
179
libxdp
180
libxkbcommon libxkbcommon.so
181
lzo
182
mesa
183
ncurses libncursesw.so
184
ndctl
185
numactl libnuma.so
186
pam libpam.so
187
pixman libpixman-1.so
188
seabios
189
sdl2
190
sdl2_image
191
snappy
192
spice libspice-server.so
193
systemd-libs libudev.so
194
usbredir
195
virglrenderer
196
vde2
197
vte3 libvte-2.91.so
198
zlib
199
zstd libzstd.so
200
)
201
optdepends=(
202
'brltty: for braille device support'
203
'qemu-arch-extra-git: extra architectures support'
204
)
205
conflicts=('qemu-headless' 'qemu' 'qemu-desktop')
206
provides=('qemu-headless' 'qemu')
207
208
_package full
209
}
210
211
package_qemu-headless-git() {
212
pkgdesc="QEMU without GUI. Git version."
213
depends=(
214
bzip2 libbz2.so
215
curl libcurl.so
216
dtc
217
fuse3
218
gcc-libs
219
glib2 libgio-2.0.so libglib-2.0.so libgmodule-2.0.so libgobject-2.0.so
220
gnutls
221
libaio
222
libbpf libbpf.so
223
libcacard
224
libcap-ng libcap-ng.so
225
libjpeg libjpeg.so
226
libnfs
227
libpng
228
libsasl
229
libseccomp libseccomp.so
230
libslirp libslirp.so
231
libssh libssh.so
232
libusb libusb-1.0.so
233
liburing liburing.so
234
libxkbcommon libxkbcommon.so
235
lzo
236
ndctl
237
numactl libnuma.so
238
ncurses libncursesw.so
239
pam libpam.so
240
pixman libpixman-1.so
241
seabios
242
snappy
243
spice libspice-server.so
244
systemd-libs libudev.so
245
usbredir
246
vde2
247
zlib
248
zstd libzstd.so
249
)
250
optdepends=('qemu-headless-arch-extra-git: extra architectures support')
251
conflicts=('qemu-headless' 'qemu' 'qemu-base')
252
provides=('qemu-headless' 'qemu')
253
254
_package headless
255
}
256
257
_package() {
258
optdepends+=('ovmf: Tianocore UEFI firmware for qemu'
259
'samba: SMB/CIFS server support'
260
'qemu-block-iscsi-git: iSCSI block support')
261
install=qemu.install
262
options=(!strip !emptydirs)
263
264
DESTDIR="$pkgdir" ninja -C "${srcdir}/${_gitname}/build-$1" install "${@:2}"
265
266
# systemd stuff
267
install -Dm644 65-kvm.rules "$pkgdir/usr/lib/udev/rules.d/65-kvm.rules"
268
269
# remove conflicting /var/run directory
270
cd "$pkgdir"
271
rm -r var
272
273
cd usr/lib
274
275
# bridge_helper needs suid
276
# https://bugs.archlinux.org/task/32565
277
chmod u+s qemu/qemu-bridge-helper
278
279
# remove split block modules
280
rm qemu/block-iscsi.so
281
282
cd ../bin
283
284
# remove extra arch
285
for _bin in qemu-*; do
286
[[ -f $_bin ]] || continue
287
288
case ${_bin#qemu-} in
289
# guest agent
290
ga) rm "$_bin"; continue ;;
291
292
# tools
293
edid|img|io|keymap|nbd|pr-helper|storage-daemon) continue ;;
294
295
# core emu
296
system-${_corearch}) continue ;;
297
esac
298
299
mv "$_bin" "$srcdir/$_gitname/extra-arch-$1/usr/bin"
300
done
301
302
cd ../share/qemu
303
for _blob in *; do
304
[[ -f $_blob ]] || continue
305
306
case $_blob in
307
# provided by seabios package
308
bios.bin|bios-256k.bin|vgabios-cirrus.bin|vgabios-qxl.bin|\
309
vgabios-stdvga.bin|vgabios-vmware.bin|vgabios-virtio.bin|vgabios-bochs-display.bin|\
310
vgabios-ramfb.bin|bios-microvm.bin|vgabios-ati.bin) rm "$_blob"; continue ;;
311
312
# provided by edk2-ovmf package
313
edk2-*) rm "$_blob"; continue ;;
314
315
# iPXE ROMs
316
efi-*|pxe-*) continue ;;
317
318
# core blobs
319
bios-microvm.bin|kvmvapic.bin|linuxboot*|multiboot.bin|sgabios.bin|vgabios*) continue ;;
320
321
# Trace events definitions
322
trace-events*) continue ;;
323
esac
324
325
mv "$_blob" "$srcdir/$_gitname/extra-arch-$1/usr/share/qemu"
326
done
327
328
# provided by edk2-ovmf package
329
rm -r firmware
330
331
cd ..
332
if [ "$1" = headless ]; then rm -r {applications,icons}; fi
333
}
334
335
package_qemu-arch-extra-git() {
336
pkgdesc="QEMU for foreign architectures. Git version."
337
depends=(
338
dtc
339
fuse3
340
gcc-libs
341
gnutls
342
libaio
343
libbpf libbpf.so
344
glib2 libgio-2.0.so libglib-2.0.so libgobject-2.0.so libgmodule-2.0.so
345
libjpeg libjpeg.so
346
libpng
347
libsasl
348
libseccomp libseccomp.so
349
libslirp libslirp.so
350
liburing liburing.so
351
lzo
352
ndctl
353
numactl libnuma.so
354
pam libpam.so
355
pixman libpixman-1.so
356
snappy
357
systemd-libs
358
libudev.so
359
qemu-git
360
vde2
361
zlib
362
zstd
363
libzstd.so
364
)
365
optdepends=(
366
'edk2-armvirt: for aarch64 UEFI support'
367
'edk2-ovmf: for ia32 and x64 UEFI support'
368
)
369
options=(!strip)
370
provides=(qemu-arch-extra)
371
conflicts=(qemu-arch-extra qemu-emulators-full)
372
373
mv -v "$srcdir/$_gitname/extra-arch-full/usr" "$pkgdir"
374
}
375
376
package_qemu-headless-arch-extra-git() {
377
pkgdesc="QEMU without GUI, for foreign architectures. Git version."
378
depends=(
379
dtc
380
fuse3
381
gcc-libs
382
gnutls
383
libaio
384
libbpf libbpf.so
385
glib2 libgio-2.0.so libglib-2.0.so libgobject-2.0.so libgmodule-2.0.so
386
libjpeg libjpeg.so
387
libpng
388
libsasl
389
libseccomp libseccomp.so
390
libslirp libslirp.so
391
liburing liburing.so
392
lzo
393
ndctl
394
numactl libnuma.so
395
pam libpam.so
396
pixman libpixman-1.so
397
snappy
398
qemu-headless-git
399
systemd-libs libudev.so
400
vde2
401
zlib
402
zstd libzstd.so
403
)
404
optdepends=(
405
'edk2-armvirt: for aarch64 UEFI support'
406
'edk2-ovmf: for ia32 and x64 UEFI support'
407
)
408
options=(!strip)
409
conflicts=(qemu-headless-arch-extra qemu-emulators-full)
410
provides=(qemu-headless-arch-extra)
411
412
mv -v "$srcdir/$_gitname/extra-arch-headless/usr" "$pkgdir"
413
}
414
415
package_qemu-block-iscsi-git() {
416
pkgdesc="QEMU iSCSI block module. Git version."
417
depends=(glibc libiscsi)
418
conflicts=(qemu-block-iscsi)
419
provides=(qemu-block-iscsi)
420
421
install -vDm 755 "$srcdir/$_gitname/build-full/block-iscsi.so" -t "$pkgdir/usr/lib/qemu/"
422
}
423
424
package_qemu-guest-agent-git() {
425
pkgdesc="QEMU Guest Agent. Git version."
426
depends=(gcc-libs glib2 libudev.so liburing)
427
conflicts=(qemu-guest-agent)
428
provides=(qemu-guest-agent)
429
install=qemu-guest-agent.install
430
431
install -vDm 755 "$srcdir/$_gitname/build-full/qga/qemu-ga" -t "$pkgdir/usr/bin/"
432
install -vDm 644 "$srcdir/qemu-guest-agent.service" -t "$pkgdir/usr/lib/systemd/system/"
433
install -vDm 755 "$srcdir/$_gitname/scripts/qemu-guest-agent/fsfreeze-hook" -t "$pkgdir/etc/qemu/"
434
}
435
436
# vim:set ts=2 sw=2 et:
437
Changes since previous scan
--- PKGBUILD @ 2026-06-21 08:09+++ PKGBUILD @ 2026-08-03 00:08@@ -16,7 +16,7 @@ qemu-guest-agent-git ) pkgdesc="A generic and open source machine emulator and virtualizer. Git version."-pkgver=11.0.0.r2279.gb833716681+pkgver=11.1.0.rc0.r19.g5ef0ecc594 pkgrel=1 epoch=28 arch=(i686 x86_64)Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 00:14:47 | LOW | 2 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 00:24:15 | LOW | 2 |
| 2026-07-20 00:19:49 | LOW | 2 |
| 2026-07-19 00:17:08 | LOW | 2 |
| 2026-07-18 00:14:48 | LOW | 2 |
| 2026-07-17 17:55:33 | MEDIUM | 1 |
| 2026-06-21 08:09:43 | CLEAN | 2 |
| 2026-06-18 16:11:54 | CLEAN | 0 |