sudo-selinux

maintainer IooNag · 17 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is a tarball from the official project domain (sudo.ws), which is plausibly the project's own release infrastructure; building from source is normal AUR packaging, even if the host is not on a whitelist.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a tarball from the official project domain (sudo.ws), which is plausibly the project's own release infrastructure; building from source is normal AUR packaging, even if the host is not on a whitelist.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:29 source=(https://www.sudo.ws/sudo/dist/${pkgname/-selinux}-$_sudover.tar.gz{,.sig}

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Evangelos Foutras <foutrelis@archlinux.org>
    
      2# Contributor: Allan McRae <allan@archlinux.org>
    
      3# Contributor: Tom Newsom <Jeepster@gmx.co.uk>
    
      4# SELinux Maintainer: Nicolas Iooss (nicolas <dot> iooss <at> m4x <dot> org)
    
      5# SELinux Contributor: Timothée Ravier <tim@siosm.fr>
    
      6# SELinux Contributor: Nicky726 <Nicky726@gmail.com>
    
      7#
    
      8# This PKGBUILD is maintained on https://github.com/archlinuxhardened/selinux.
    
      9# If you want to help keep it up to date, please open a Pull Request there.
    
      10
    
      11pkgname=sudo-selinux
    
      12_sudover=1.9.17p2
    
      13pkgrel=6
    
      14pkgver=${_sudover/p/.p}
    
      15pkgdesc="Give certain users the ability to run some commands as root - SELinux support"
    
      16arch=('x86_64' 'aarch64')
    
      17url="https://www.sudo.ws/sudo/"
    
      18license=('custom')
    
      19groups=('selinux')
    
      20depends=('glibc' 'openssl' 'pam-selinux' 'libldap' 'zlib' 'libselinux')
    
      21conflicts=("${pkgname/-selinux}" "selinux-${pkgname/-selinux}")
    
      22provides=("${pkgname/-selinux}=${pkgver}-${pkgrel}"
    
      23          "selinux-${pkgname/-selinux}=${pkgver}-${pkgrel}")
    
      24backup=('etc/pam.d/sudo'
    
      25        'etc/sudo.conf'
    
      26        'etc/sudo_logsrvd.conf'
    
      27        'etc/sudoers')
    
      28install=${pkgname/-selinux}.install
    
      29source=(https://www.sudo.ws/sudo/dist/${pkgname/-selinux}-$_sudover.tar.gz{,.sig}
    
      30        sudo_logsrvd.service
    
      31        sudo.pam)
    
      32sha256sums=('4a38a1ab3adb1199257edc2a7c4a2bd714665eb605b04368843b06dada2cfcfb'
    
      33            'SKIP'
    
      34            'bd4bc2f5d85cbe14d7e7acc5008cb4fe62c38de7d42dc6876c87bfaa273c0a6e'
    
      35            '7ec1c668c10e0f83d00e25f336872212fe04ce2c2563e1d661d34d28852f4649')
    
      36validpgpkeys=('59D1E9CCBA2B376704FDD35BA9F4C021CEA470FB')
    
      37
    
      38prepare() {
    
      39  cd "${pkgname/-selinux}-$_sudover"
    
      40}
    
      41
    
      42build() {
    
      43  cd "${pkgname/-selinux}-$_sudover"
    
      44
    
      45  ./configure \
    
      46    --prefix=/usr \
    
      47    --sbindir=/usr/bin \
    
      48    --libexecdir=/usr/lib \
    
      49    --with-rundir=/run/sudo \
    
      50    --with-vardir=/var/db/sudo \
    
      51    --with-logfac=auth \
    
      52    --enable-tmpfiles.d \
    
      53    --with-pam \
    
      54    --with-sssd \
    
      55    --with-ldap \
    
      56    --with-ldap-conf-file=/etc/openldap/ldap.conf \
    
      57    --with-env-editor \
    
      58    --with-passprompt="[sudo] password for %p: " \
    
      59    --with-secure-path-value=/usr/local/sbin:/usr/local/bin:/usr/bin \
    
      60    --with-all-insults \
    
      61    --with-selinux
    
      62  make
    
      63}
    
      64
    
      65check() {
    
      66  cd "${pkgname/-selinux}-$_sudover"
    
      67  make check
    
      68}
    
      69
    
      70package() {
    
      71  depends+=('libcrypto.so' 'libssl.so')
    
      72
    
      73  cd "$srcdir/${pkgname/-selinux}-$_sudover"
    
      74  make DESTDIR="$pkgdir" install
    
      75
    
      76  # sudo_logsrvd service file (taken from sudo-logsrvd-1.9.0-1.el8.x86_64.rpm)
    
      77  install -Dm644 -t "$pkgdir/usr/lib/systemd/system" ../sudo_logsrvd.service
    
      78
    
      79  # Remove sudoers.dist; not needed since pacman manages updates to sudoers
    
      80  rm "$pkgdir/etc/sudoers.dist"
    
      81
    
      82  # Remove /run/sudo directory; we create it using systemd-tmpfiles
    
      83  rmdir "$pkgdir/run/sudo"
    
      84  rmdir "$pkgdir/run"
    
      85
    
      86  install -Dm644 "$srcdir/sudo.pam" "$pkgdir/etc/pam.d/sudo"
    
      87
    
      88  install -Dm644 LICENSE.md -t "$pkgdir/usr/share/licenses/sudo-selinux"
    
      89}
    
      90
    
      91# vim:set ts=2 sw=2 et:
    
      92

Changes since previous scan

--- PKGBUILD @ 2026-06-19 19:07
+++ PKGBUILD @ 2026-08-03 00:08
@@ -10,7 +10,7 @@
 
 pkgname=sudo-selinux
 _sudover=1.9.17p2
-pkgrel=1
+pkgrel=6
 pkgver=${_sudover/p/.p}
 pkgdesc="Give certain users the ability to run some commands as root - SELinux support"
 arch=('x86_64' 'aarch64')
@@ -32,7 +32,7 @@
 sha256sums=('4a38a1ab3adb1199257edc2a7c4a2bd714665eb605b04368843b06dada2cfcfb'
             'SKIP'
             'bd4bc2f5d85cbe14d7e7acc5008cb4fe62c38de7d42dc6876c87bfaa273c0a6e'
-            'd1738818070684a5d2c9b26224906aad69a4fea77aabd960fc2675aee2df1fa2')
+            '7ec1c668c10e0f83d00e25f336872212fe04ce2c2563e1d661d34d28852f4649')
 validpgpkeys=('59D1E9CCBA2B376704FDD35BA9F4C021CEA470FB')
 
 prepare() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 21:16:48	MEDIUM	1
2026-06-19 19:07:35	CLEAN	2
2026-06-19 18:54:17	CLEAN	2
2026-06-18 16:11:54	MEDIUM	1