qemu-git

LOW
maintainer FredBezies 30 votes scanned 2026-09-17 00:27:14.276658
View on AUR
Why flagged

The setuid permission on qemu-bridge-helper is a legitimate requirement for network functionality and is a known, documented exception in QEMU packaging.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The setuid permission on qemu-bridge-helper is a legitimate requirement for network functionality and is a known, documented exception in QEMU packaging.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

  • PKGBUILD:277 chmod u+s qemu/qemu-bridge-helper

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: Frederic Bezies <fredbezies@gmail.com>
2# Contributor: ajs124 < aur at ajs124 dot de>
3# Contributor: Devin Cofer <ranguvar{AT]archlinux[DOT}us>
4# Contributor: Tobias Powalowski <tpowa@archlinux.org>
5# Contributor: David Runge <dvzrv@archlinux.org>
6# Contributor: Sébastien "Seblu" Luttringer <seblu@seblu.net>
7
8pkgbase=qemu-git
9_gitname=qemu
10pkgname=(
11 qemu-git
12 qemu-headless-git
13 qemu-arch-extra-git
14 qemu-headless-arch-extra-git
15 qemu-block-iscsi-git
16 qemu-guest-agent-git
17)
18pkgdesc="A generic and open source machine emulator and virtualizer. Git version."
19pkgver=11.1.0.r1168.gff1d2d19d7
20pkgrel=1
21epoch=29
22arch=(i686 x86_64)
23license=(GPL-2.0-or-later LGPL-2.1-or-later)
24url="https://wiki.qemu.org/"
25# TODO: consider providing rdma-core
26# TODO: consider providing lzfse
27makedepends=(
28 alsa-lib
29 brltty
30 bzip2
31 cairo
32 capstone
33 curl
34 cdrtools
35 dtc
36 fuse3
37 gcc-libs
38 gdk-pixbuf2
39 git
40 glib2
41 gnutls
42 gtk3
43 jack
44 libaio
45 libbpf
46 libcacard
47 libcap-ng
48 libepoxy
49 libiscsi
50 libnfs
51 libpng
52 libpulse
53 libsasl
54 libseccomp
55 libslirp
56 libssh
57 liburing
58 libusb
59 libx11
60 libxkbcommon
61 lzo
62 mesa
63 meson
64 ncurses
65 ndctl
66 numactl
67 pam
68 pixman
69 python
70 python-sphinx
71 python-sphinx_rtd_theme
72 sdl2
73 sdl2_image
74 seabios
75 snappy
76 spice-protocol
77 spice
78 systemd
79 usbredir
80 vde2
81 virglrenderer
82 vte3 libvte-2.91.so
83 xfsprogs
84 zlib
85 zstd
86)
87options=(!debug !lto)
88source=(git+https://gitlab.com/qemu-project/qemu.git
89 qemu-guest-agent.service
90 65-kvm.rules)
91sha256sums=('SKIP'
92 'c39bcde4a09165e64419fd2033b3532378bba84d509d39e2d51694d44c1f8d88'
93 'a66f0e791b16b03b91049aac61a25950d93e962e1b2ba64a38c6ad7f609b532c')
94
95case $CARCH in
96 i?86) _corearch=i386 ;;
97 x86_64) _corearch=x86_64 ;;
98esac
99
100pkgver() {
101 cd "${srcdir}/${_gitname}"
102 git describe --long --tags | sed 's/\([^-]*-g\)/r\1/;s/-/./g' | cut -c2-47
103}
104
105prepare() {
106 cd "${srcdir}/${_gitname}"
107 mkdir build-{full,headless}
108 mkdir -p extra-arch-{full,headless}/usr/{bin,share/qemu}
109}
110
111build() {
112 _build full
113
114 _build headless \
115 --audio-drv-list= \
116 --disable-gtk \
117 --disable-vte \
118 --disable-brlapi \
119 --disable-opengl \
120 --disable-dbus-display \
121 --disable-virglrenderer \
122 --disable-alsa \
123 --disable-jack \
124 --disable-oss \
125 --disable-pa \
126 --disable-sdl
127}
128
129_build() (
130
131 cd ${srcdir}/${_gitname}/build-$1
132
133 ../configure \
134 --prefix=/usr \
135 --sysconfdir=/etc \
136 --localstatedir=/var \
137 --libexecdir=/usr/lib/qemu \
138 --smbd=/usr/bin/smbd \
139 --enable-modules \
140 --enable-sdl \
141 --disable-werror #\
142 #"${@:2}"
143
144 ninja
145)
146
147package_qemu-git() {
148 pkgdesc="QEMU Git version."
149 depends=(
150 alsa-lib libasound.so
151 bzip2 libbz2.so
152 cairo
153 capstone
154 curl libcurl.so
155 dtc
156 fuse3
157 gcc-libs
158 gdk-pixbuf2 libgdk_pixbuf-2.0.so
159 glib2 libgio-2.0.so libglib-2.0.so libgmodule-2.0.so libgobject-2.0.so
160 gnutls
161 gtk3 libgdk-3.so libgtk-3.so
162 jack libjack.so
163 libaio
164 libbpf libbpf.so
165 libcacard
166 libcap-ng libcap-ng.so
167 libepoxy
168 libjpeg-turbo libjpeg.so
169 libnfs
170 libpng
171 libpulse libpulse.so
172 libsasl
173 libseccomp libseccomp.so
174 libslirp libslirp.so
175 libssh libssh.so
176 libusb libusb-1.0.so
177 liburing liburing.so
178 libx11
179 libxdp
180 libxkbcommon libxkbcommon.so
181 lzo
182 mesa
183 ncurses libncursesw.so
184 ndctl
185 numactl libnuma.so
186 pam libpam.so
187 pixman libpixman-1.so
188 seabios
189 sdl2
190 sdl2_image
191 snappy
192 spice libspice-server.so
193 systemd-libs libudev.so
194 usbredir
195 virglrenderer
196 vde2
197 vte3 libvte-2.91.so
198 zlib
199 zstd libzstd.so
200 )
201 optdepends=(
202 'brltty: for braille device support'
203 'qemu-arch-extra-git: extra architectures support'
204 )
205 conflicts=('qemu-headless' 'qemu' 'qemu-desktop')
206 provides=('qemu-headless' 'qemu')
207
208 _package full
209}
210
211package_qemu-headless-git() {
212 pkgdesc="QEMU without GUI. Git version."
213 depends=(
214 bzip2 libbz2.so
215 curl libcurl.so
216 dtc
217 fuse3
218 gcc-libs
219 glib2 libgio-2.0.so libglib-2.0.so libgmodule-2.0.so libgobject-2.0.so
220 gnutls
221 libaio
222 libbpf libbpf.so
223 libcacard
224 libcap-ng libcap-ng.so
225 libjpeg-turbo libjpeg.so
226 libnfs
227 libpng
228 libsasl
229 libseccomp libseccomp.so
230 libslirp libslirp.so
231 libssh libssh.so
232 libusb libusb-1.0.so
233 liburing liburing.so
234 libxkbcommon libxkbcommon.so
235 lzo
236 ndctl
237 numactl libnuma.so
238 ncurses libncursesw.so
239 pam libpam.so
240 pixman libpixman-1.so
241 seabios
242 snappy
243 spice libspice-server.so
244 systemd-libs libudev.so
245 usbredir
246 vde2
247 zlib
248 zstd libzstd.so
249 )
250 optdepends=('qemu-headless-arch-extra-git: extra architectures support')
251 conflicts=('qemu-headless' 'qemu' 'qemu-base')
252 provides=('qemu-headless' 'qemu')
253
254 _package headless
255}
256
257_package() {
258 optdepends+=('ovmf: Tianocore UEFI firmware for qemu'
259 'samba: SMB/CIFS server support'
260 'qemu-block-iscsi-git: iSCSI block support')
261 install=qemu.install
262 options=(!strip !emptydirs)
263
264 DESTDIR="$pkgdir" ninja -C "${srcdir}/${_gitname}/build-$1" install "${@:2}"
265
266 # systemd stuff
267 install -Dm644 65-kvm.rules "$pkgdir/usr/lib/udev/rules.d/65-kvm.rules"
268
269 # remove conflicting /var/run directory
270 cd "$pkgdir"
271 rm -r var
272
273 cd usr/lib
274
275 # bridge_helper needs suid
276 # https://bugs.archlinux.org/task/32565
277 chmod u+s qemu/qemu-bridge-helper
278
279 # remove split block modules
280 rm qemu/block-iscsi.so
281
282 cd ../bin
283
284 # remove extra arch
285 for _bin in qemu-*; do
286 [[ -f $_bin ]] || continue
287
288 case ${_bin#qemu-} in
289 # guest agent
290 ga) rm "$_bin"; continue ;;
291
292 # tools
293 edid|img|io|keymap|nbd|pr-helper|storage-daemon) continue ;;
294
295 # core emu
296 system-${_corearch}) continue ;;
297 esac
298
299 mv "$_bin" "$srcdir/$_gitname/extra-arch-$1/usr/bin"
300 done
301
302 cd ../share/qemu
303 for _blob in *; do
304 [[ -f $_blob ]] || continue
305
306 case $_blob in
307 # provided by seabios package
308 bios.bin|bios-256k.bin|vgabios-cirrus.bin|vgabios-qxl.bin|\
309 vgabios-stdvga.bin|vgabios-vmware.bin|vgabios-virtio.bin|vgabios-bochs-display.bin|\
310 vgabios-ramfb.bin|bios-microvm.bin|vgabios-ati.bin) rm "$_blob"; continue ;;
311
312 # provided by edk2-ovmf package
313 edk2-*) rm "$_blob"; continue ;;
314
315 # iPXE ROMs
316 efi-*|pxe-*) continue ;;
317
318 # core blobs
319 bios-microvm.bin|kvmvapic.bin|linuxboot*|multiboot.bin|sgabios.bin|vgabios*) continue ;;
320
321 # Trace events definitions
322 trace-events*) continue ;;
323 esac
324
325 mv "$_blob" "$srcdir/$_gitname/extra-arch-$1/usr/share/qemu"
326 done
327
328 # provided by edk2-ovmf package
329 rm -r firmware
330
331 cd ..
332 if [ "$1" = headless ]; then rm -r {applications,icons}; fi
333}
334
335package_qemu-arch-extra-git() {
336 pkgdesc="QEMU for foreign architectures. Git version."
337 depends=(
338 dtc
339 fuse3
340 gcc-libs
341 gnutls
342 libaio
343 libbpf libbpf.so
344 glib2 libgio-2.0.so libglib-2.0.so libgobject-2.0.so libgmodule-2.0.so
345 libjpeg-turbo libjpeg.so
346 libpng
347 libsasl
348 libseccomp libseccomp.so
349 libslirp libslirp.so
350 liburing liburing.so
351 lzo
352 ndctl
353 numactl libnuma.so
354 pam libpam.so
355 pixman libpixman-1.so
356 snappy
357 systemd-libs
358 libudev.so
359 qemu-git
360 vde2
361 zlib
362 zstd
363 libzstd.so
364 )
365 optdepends=(
366 'edk2-armvirt: for aarch64 UEFI support'
367 'edk2-ovmf: for ia32 and x64 UEFI support'
368 )
369 options=(!strip)
370 provides=(qemu-arch-extra)
371 conflicts=(qemu-arch-extra qemu-emulators-full)
372
373 mv -v "$srcdir/$_gitname/extra-arch-full/usr" "$pkgdir"
374}
375
376package_qemu-headless-arch-extra-git() {
377 pkgdesc="QEMU without GUI, for foreign architectures. Git version."
378 depends=(
379 dtc
380 fuse3
381 gcc-libs
382 gnutls
383 libaio
384 libbpf libbpf.so
385 glib2 libgio-2.0.so libglib-2.0.so libgobject-2.0.so libgmodule-2.0.so
386 libjpeg-turbo libjpeg.so
387 libpng
388 libsasl
389 libseccomp libseccomp.so
390 libslirp libslirp.so
391 liburing liburing.so
392 lzo
393 ndctl
394 numactl libnuma.so
395 pam libpam.so
396 pixman libpixman-1.so
397 snappy
398 qemu-headless-git
399 systemd-libs libudev.so
400 vde2
401 zlib
402 zstd libzstd.so
403 )
404 optdepends=(
405 'edk2-armvirt: for aarch64 UEFI support'
406 'edk2-ovmf: for ia32 and x64 UEFI support'
407 )
408 options=(!strip)
409 conflicts=(qemu-headless-arch-extra qemu-emulators-full)
410 provides=(qemu-headless-arch-extra)
411
412 mv -v "$srcdir/$_gitname/extra-arch-headless/usr" "$pkgdir"
413}
414
415package_qemu-block-iscsi-git() {
416 pkgdesc="QEMU iSCSI block module. Git version."
417 depends=(glibc libiscsi)
418 conflicts=(qemu-block-iscsi)
419 provides=(qemu-block-iscsi)
420
421 install -vDm 755 "$srcdir/$_gitname/build-full/block-iscsi.so" -t "$pkgdir/usr/lib/qemu/"
422}
423
424package_qemu-guest-agent-git() {
425 pkgdesc="QEMU Guest Agent. Git version."
426 depends=(gcc-libs glib2 libudev.so liburing)
427 conflicts=(qemu-guest-agent)
428 provides=(qemu-guest-agent)
429 install=qemu-guest-agent.install
430
431 install -vDm 755 "$srcdir/$_gitname/build-full/qga/qemu-ga" -t "$pkgdir/usr/bin/"
432 install -vDm 644 "$srcdir/qemu-guest-agent.service" -t "$pkgdir/usr/lib/systemd/system/"
433 install -vDm 755 "$srcdir/$_gitname/scripts/qemu-guest-agent/fsfreeze-hook" -t "$pkgdir/etc/qemu/"
434}
435
436# vim:set ts=2 sw=2 et:
437

Changes since previous scan

--- PKGBUILD @ 2026-09-05 00:16
+++ PKGBUILD @ 2026-09-17 00:27
@@ -16,7 +16,7 @@
qemu-guest-agent-git
)
pkgdesc="A generic and open source machine emulator and virtualizer. Git version."
-pkgver=11.1.0.r97.gd5393e5a03
+pkgver=11.1.0.r1168.gff1d2d19d7
pkgrel=1
epoch=29
arch=(i686 x86_64)
@@ -165,7 +165,7 @@
libcacard
libcap-ng libcap-ng.so
libepoxy
- libjpeg libjpeg.so
+ libjpeg-turbo libjpeg.so
libnfs
libpng
libpulse libpulse.so
@@ -222,7 +222,7 @@
libbpf libbpf.so
libcacard
libcap-ng libcap-ng.so
- libjpeg libjpeg.so
+ libjpeg-turbo libjpeg.so
libnfs
libpng
libsasl
@@ -342,7 +342,7 @@
libaio
libbpf libbpf.so
glib2 libgio-2.0.so libglib-2.0.so libgobject-2.0.so libgmodule-2.0.so
- libjpeg libjpeg.so
+ libjpeg-turbo libjpeg.so
libpng
libsasl
libseccomp libseccomp.so
@@ -383,7 +383,7 @@
libaio
libbpf libbpf.so
glib2 libgio-2.0.so libglib-2.0.so libgobject-2.0.so libgmodule-2.0.so
- libjpeg libjpeg.so
+ libjpeg-turbo libjpeg.so
libpng
libsasl
libseccomp libseccomp.so

Scan history

Scanned at (UTC)SeverityRules
2026-09-17 00:27:14 Low 2
2026-09-16 00:03:17 Low 2
2026-09-15 00:25:31 Low 2
2026-09-14 00:27:57 Low 2
2026-09-13 00:19:54 Low 2
2026-09-12 00:25:17 Low 2
2026-09-11 00:19:22 Low 2
2026-09-10 00:22:44 Low 2
2026-09-09 00:04:09 Low 2
2026-09-08 00:18:08 Low 2
2026-09-07 00:30:15 Low 2
2026-09-06 00:17:06 Low 2
2026-09-05 14:00:22 Medium 1
2026-09-05 00:16:27 Low 2
2026-09-04 00:03:13 Low 2
2026-09-03 00:15:47 Low 2
2026-09-02 00:02:31 Low 2
2026-09-01 00:11:19 Low 2
2026-08-31 00:19:57 Low 2
2026-08-30 00:04:14 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion