sudo-selinux

LOW

maintainer IooNag 17 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The source is a tarball from the official project domain (sudo.ws), which is plausibly the project's own release infrastructure; building from source is normal AUR packaging, even if the host is not on a whitelist.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a tarball from the official project domain (sudo.ws), which is plausibly the project's own release infrastructure; building from source is normal AUR packaging, even if the host is not on a whitelist.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:29 source=(https://www.sudo.ws/sudo/dist/${pkgname/-selinux}-$_sudover.tar.gz{,.sig}

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Evangelos Foutras <foutrelis@archlinux.org>
    
      2# Contributor: Allan McRae <allan@archlinux.org>
    
      3# Contributor: Tom Newsom <Jeepster@gmx.co.uk>
    
      4# SELinux Maintainer: Nicolas Iooss (nicolas <dot> iooss <at> m4x <dot> org)
    
      5# SELinux Contributor: Timothée Ravier <tim@siosm.fr>
    
      6# SELinux Contributor: Nicky726 <Nicky726@gmail.com>
    
      7#
    
      8# This PKGBUILD is maintained on https://github.com/archlinuxhardened/selinux.
    
      9# If you want to help keep it up to date, please open a Pull Request there.
    
      10
    
      11pkgname=sudo-selinux
    
      12_sudover=1.9.17p2
    
      13pkgrel=6
    
      14pkgver=${_sudover/p/.p}
    
      15pkgdesc="Give certain users the ability to run some commands as root - SELinux support"
    
      16arch=('x86_64' 'aarch64')
    
      17url="https://www.sudo.ws/sudo/"
    
      18license=('custom')
    
      19groups=('selinux')
    
      20depends=('glibc' 'openssl' 'pam-selinux' 'libldap' 'zlib' 'libselinux')
    
      21conflicts=("${pkgname/-selinux}" "selinux-${pkgname/-selinux}")
    
      22provides=("${pkgname/-selinux}=${pkgver}-${pkgrel}"
    
      23          "selinux-${pkgname/-selinux}=${pkgver}-${pkgrel}")
    
      24backup=('etc/pam.d/sudo'
    
      25        'etc/sudo.conf'
    
      26        'etc/sudo_logsrvd.conf'
    
      27        'etc/sudoers')
    
      28install=${pkgname/-selinux}.install
    
      29source=(https://www.sudo.ws/sudo/dist/${pkgname/-selinux}-$_sudover.tar.gz{,.sig}
    
      30        sudo_logsrvd.service
    
      31        sudo.pam)
    
      32sha256sums=('4a38a1ab3adb1199257edc2a7c4a2bd714665eb605b04368843b06dada2cfcfb'
    
      33            'SKIP'
    
      34            'bd4bc2f5d85cbe14d7e7acc5008cb4fe62c38de7d42dc6876c87bfaa273c0a6e'
    
      35            '7ec1c668c10e0f83d00e25f336872212fe04ce2c2563e1d661d34d28852f4649')
    
      36validpgpkeys=('59D1E9CCBA2B376704FDD35BA9F4C021CEA470FB')
    
      37
    
      38prepare() {
    
      39  cd "${pkgname/-selinux}-$_sudover"
    
      40}
    
      41
    
      42build() {
    
      43  cd "${pkgname/-selinux}-$_sudover"
    
      44
    
      45  ./configure \
    
      46    --prefix=/usr \
    
      47    --sbindir=/usr/bin \
    
      48    --libexecdir=/usr/lib \
    
      49    --with-rundir=/run/sudo \
    
      50    --with-vardir=/var/db/sudo \
    
      51    --with-logfac=auth \
    
      52    --enable-tmpfiles.d \
    
      53    --with-pam \
    
      54    --with-sssd \
    
      55    --with-ldap \
    
      56    --with-ldap-conf-file=/etc/openldap/ldap.conf \
    
      57    --with-env-editor \
    
      58    --with-passprompt="[sudo] password for %p: " \
    
      59    --with-secure-path-value=/usr/local/sbin:/usr/local/bin:/usr/bin \
    
      60    --with-all-insults \
    
      61    --with-selinux
    
      62  make
    
      63}
    
      64
    
      65check() {
    
      66  cd "${pkgname/-selinux}-$_sudover"
    
      67  make check
    
      68}
    
      69
    
      70package() {
    
      71  depends+=('libcrypto.so' 'libssl.so')
    
      72
    
      73  cd "$srcdir/${pkgname/-selinux}-$_sudover"
    
      74  make DESTDIR="$pkgdir" install
    
      75
    
      76  # sudo_logsrvd service file (taken from sudo-logsrvd-1.9.0-1.el8.x86_64.rpm)
    
      77  install -Dm644 -t "$pkgdir/usr/lib/systemd/system" ../sudo_logsrvd.service
    
      78
    
      79  # Remove sudoers.dist; not needed since pacman manages updates to sudoers
    
      80  rm "$pkgdir/etc/sudoers.dist"
    
      81
    
      82  # Remove /run/sudo directory; we create it using systemd-tmpfiles
    
      83  rmdir "$pkgdir/run/sudo"
    
      84  rmdir "$pkgdir/run"
    
      85
    
      86  install -Dm644 "$srcdir/sudo.pam" "$pkgdir/etc/pam.d/sudo"
    
      87
    
      88  install -Dm644 LICENSE.md -t "$pkgdir/usr/share/licenses/sudo-selinux"
    
      89}
    
      90
    
      91# vim:set ts=2 sw=2 et:
    
      92

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2