util-linux-aes

MEDIUM

maintainer TrialnError 6 votes scanned 2026-08-26 21:30:41.721447

View on AUR

Why flagged

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

Triggered rules

Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

PKGBUILD:141 chmod 4755 "${pkgdir}"/usr/bin/{newgrp,ch{sh,fn}}

PKGBUILD

1 offending line(s) highlighted

      1# Contributor: Lex Black <autumn-wind@web.de>
    
      2# Contributor: xerc <aur[at]xerc.de>
    
      3# Contributor: Tom Gundersen <teg@jklm.no>
    
      4# Contributor: Dave Reisner <dreisner@archlinux.org>
    
      5# Contributor: milomouse <vincent[at]fea.st>
    
      6# Contributor: judd <jvinet@zeroflux.org>
    
      7
    
      8_basename=util-linux
    
      9pkgbase=util-linux-aes
    
      10pkgname=(util-linux-aes util-linux-libs-aes)
    
      11_pkgmajor=2.42
    
      12_realver=${_pkgmajor}.2
    
      13pkgver=${_realver/-/}
    
      14pkgrel=1
    
      15pkgdesc='Miscellaneous system utilities for Linux, with loop-AES support'
    
      16url='https://github.com/util-linux/util-linux'
    
      17#url="http://sourceforge.net/projects/loop-aes/"
    
      18arch=('x86_64')
    
      19makedepends=('asciidoctor'
    
      20             'bash-completion'
    
      21             'gtk-doc'
    
      22             'libcap-ng'
    
      23             'libxcrypt'
    
      24             'po4a'
    
      25             'python'
    
      26             'sqlite'
    
      27             'systemd')
    
      28license=(
    
      29  'BSD-2-Clause'
    
      30  'BSD-3-Clause'
    
      31  'BSD-4-Clause-UC'
    
      32  'GPL-2.0-only'
    
      33  'GPL-2.0-or-later'
    
      34  'GPL-3.0-or-later'
    
      35  'ISC'
    
      36  'LGPL-2.1-or-later'
    
      37  'LicenseRef-PublicDomain'
    
      38)
    
      39options=('strip')
    
      40install=${pkgname}.install
    
      41validpgpkeys=('B0C64D14301CC6EFAEDF60E4E4B71D5EEC39C284'  # Karel Zak
    
      42              '12D64C3ADCDA0AA427BDACDFF0733C808132F189') # Jari Ruusu
    
      43source=("https://www.kernel.org/pub/linux/utils/util-linux/v${_pkgmajor}/${_basename}-${_realver}.tar."{xz,sign}
    
      44        ${_basename}-BSD-2-Clause.txt::https://raw.githubusercontent.com/Cyan4973/xxHash/f035303b8a86c1db9be70cbb638678ef6ef4cb2d/LICENSE
    
      45        "${_basename}-${pkgver}.diff"
    
      46        {login,common,remote,runuser,su}.pam
    
      47        'util-linux-aes.sysusers'
    
      48        '60-rfkill.rules'
    
      49        'rfkill-unblock_.service'
    
      50        'rfkill-block_.service')
    
      51sha256sums=('03a05d3adf9602ef128f2da05b84b3205ce60c351e5737c0370f74000679ce8a'
    
      52            'SKIP'
    
      53            '6ffedbc0f7878612d2b23589f1ff2ab15633e1df7963a5d9fc750ec5500c7e7a'
    
      54            '49c158013141086912c22e8db72cb4a1a0ccb2204b4a8cb80dc3b9d48ef00cc7'
    
      55            'ee917d55042f78b8bb03f5467e5233e3e2ddc2fe01e302bc53b218003fe22275'
    
      56            '57e057758944f4557762c6def939410c04ca5803cbdd2bfa2153ce47ffe7a4af'
    
      57            '8bfbee453618ba44d60ba7fb00eced6c62edebfc592f2e75dede08e769ed8931'
    
      58            '48d6fba767631e3dd3620cf02a71a74c5d65a525d4c4ce4b5a0b7d9f41ebfea1'
    
      59            '5f4d36be03cc980930ba0a0e109d6b5625201f88a4ae7f913d632f5ab5866b87'
    
      60            '10b0505351263a099163c0d928132706e501dd0a008dac2835b052167b14abe3'
    
      61            '7423aaaa09fee7f47baa83df9ea6fef525ff9aec395c8cbd9fe848ceb2643f37'
    
      62            '8ccec10a22523f6b9d55e0d6cbf91905a39881446710aa083e935e8073323376'
    
      63            'a22e0a037e702170c7d88460cc9c9c2ab1d3e5c54a6985cd4a164ea7beff1b36')
    
      64
    
      65_backports=(
    
      66)
    
      67
    
      68_reverts=(
    
      69)
    
      70
    
      71prepare() {
    
      72  cd "${_basename}-${pkgver}"
    
      73
    
      74  # loop-aes patch
    
      75  patch -Np1 -i "../${_basename}-${pkgver}.diff"
    
      76  autoreconf -i
    
      77
    
      78  # create fully locked system accout
    
      79  sed -i '/^u /s|u|u!|' misc-utils/uuidd-sysusers.conf.in
    
      80
    
      81  # do not mark dirty
    
      82  sed -i '/dirty=/c dirty=' tools/git-version-gen
    
      83}
    
      84
    
      85build() {
    
      86  cd "${_basename}-${pkgver}"
    
      87
    
      88  ./configure \
    
      89    --prefix=/usr \
    
      90    --libdir=/usr/lib \
    
      91    --bindir=/usr/bin \
    
      92    --sbindir=/usr/bin \
    
      93    --localstatedir=/var \
    
      94    --enable-usrdir-path \
    
      95    --enable-fs-paths-default=/usr/bin:/usr/local/bin \
    
      96    --enable-vipw \
    
      97    --enable-newgrp \
    
      98    --enable-chfn-chsh \
    
      99    --enable-write \
    
      100    --enable-mesg \
    
      101    --with-python=3
    
      102
    
      103  make
    
      104}
    
      105
    
      106package_util-linux-aes() {
    
      107  conflicts=('rfkill' 'hardlink' "${_basename}")
    
      108  provides=('rfkill' 'hardlink' "${_basename}=2.42")
    
      109  replaces=('rfkill' 'hardlink')
    
      110  depends=("util-linux-libs-aes"
    
      111           'coreutils'
    
      112           'file' 'libmagic.so'
    
      113           'glibc'
    
      114           'libcap-ng'
    
      115           'libgcc' 'libgcc_s.so'
    
      116           'libxcrypt' 'libcrypt.so'
    
      117           'ncurses' 'libncursesw.so'
    
      118           'pam'
    
      119           'readline'
    
      120           'shadow'
    
      121           'systemd-libs' 'libsystemd.so' 'libudev.so'
    
      122           'zlib')
    
      123  optdepends=('words: default dictionary for look')
    
      124  backup=(etc/pam.d/chfn
    
      125          etc/pam.d/chsh
    
      126          etc/pam.d/login
    
      127          etc/pam.d/remote
    
      128          etc/pam.d/runuser
    
      129          etc/pam.d/runuser-l
    
      130          etc/pam.d/su
    
      131          etc/pam.d/su-l)
    
      132
    
      133  _python_stdlib="$(python -c 'import sysconfig; print(sysconfig.get_paths()["stdlib"])')"
    
      134
    
      135  make -C "${_basename}-${pkgver}" DESTDIR="${pkgdir}" usrsbin_execdir=/usr/bin install
    
      136
    
      137  # remove static libraries
    
      138  rm "${pkgdir}"/usr/lib/lib*.a*
    
      139
    
      140  # setuid chfn and chsh
    
      141  chmod 4755 "${pkgdir}"/usr/bin/{newgrp,ch{sh,fn}}
    
      142
    
      143  # install PAM files for login-utils
    
      144  install -Dm0644 common.pam "${pkgdir}/etc/pam.d/chfn"
    
      145  install -Dm0644 common.pam "${pkgdir}/etc/pam.d/chsh"
    
      146  install -Dm0644 login.pam "${pkgdir}/etc/pam.d/login"
    
      147  install -Dm0644 remote.pam "${pkgdir}/etc/pam.d/remote"
    
      148  install -Dm0644 runuser.pam "${pkgdir}/etc/pam.d/runuser"
    
      149  install -Dm0644 runuser.pam "${pkgdir}/etc/pam.d/runuser-l"
    
      150  install -Dm0644 su.pam "${pkgdir}/etc/pam.d/su"
    
      151  install -Dm0644 su.pam "${pkgdir}/etc/pam.d/su-l"
    
      152
    
      153  # TODO(dreisner): offer this upstream?
    
      154  sed -i '/ListenStream/ aRuntimeDirectory=uuidd' "${pkgdir}/usr/lib/systemd/system/uuidd.socket"
    
      155
    
      156  # runtime libs are shipped as part of util-linux-libs
    
      157  install -d -m0755 util-linux-libs/lib/
    
      158  mv "$pkgdir"/usr/lib/lib*.so* util-linux-libs/lib/
    
      159  mv "$pkgdir"/usr/lib/pkgconfig util-linux-libs/lib/pkgconfig
    
      160  mv "$pkgdir"/usr/include util-linux-libs/include
    
      161  mv "$pkgdir"/"${_python_stdlib}"/site-packages util-linux-libs/site-packages
    
      162  rmdir "$pkgdir"/"${_python_stdlib}"
    
      163  mv "$pkgdir"/usr/share/man/man3 util-linux-libs/man3
    
      164
    
      165  # install systemd-sysusers
    
      166  install -Dm0644 util-linux-aes.sysusers \
    
      167    "${pkgdir}/usr/lib/sysusers.d/util-linux-aes.conf"
    
      168
    
      169  install -Dm0644 60-rfkill.rules \
    
      170    "${pkgdir}/usr/lib/udev/rules.d/60-rfkill.rules"
    
      171
    
      172  install -Dm0644 rfkill-unblock_.service \
    
      173    "${pkgdir}/usr/lib/systemd/system/rfkill-unblock@.service"
    
      174  install -Dm0644 rfkill-block_.service \
    
      175    "${pkgdir}/usr/lib/systemd/system/rfkill-block@.service"
    
      176
    
      177  install -vDm 644 ${_basename}-${pkgver}/Documentation/licenses/COPYING.{BSD*,ISC} -t "$pkgdir/usr/share/licenses/$pkgname/"
    
      178  install -vDm 644 ${_basename}-BSD-2-Clause.txt -t "$pkgdir/usr/share/licenses/$pkgname/"
    
      179}
    
      180
    
      181package_util-linux-libs-aes() {
    
      182  pkgdesc='util-linux runtime libraries updated with loop-aes'
    
      183  depends=('glibc'
    
      184           'sqlite')
    
      185  provides=('libutil-linux' 'libblkid.so' 'libfdisk.so' 'libmount.so' 'libsmartcols.so' 'libuuid.so' "${_basename}-libs=2.42")
    
      186  conflicts=('libutil-linux' "${_basename}-libs")
    
      187  replaces=('libutil-linux')
    
      188  optdepends=('python: python bindings to libmount')
    
      189
    
      190  install -d -m0755 "$pkgdir"/{"${_python_stdlib}",usr/share/man/}
    
      191  mv util-linux-libs/lib/* "$pkgdir"/usr/lib/
    
      192  mv util-linux-libs/include "$pkgdir"/usr/include
    
      193  mv util-linux-libs/site-packages "$pkgdir"/"${_python_stdlib}"/site-packages
    
      194  mv util-linux-libs/man3 "$pkgdir"/usr/share/man/man3
    
      195
    
      196  install -vDm 644 ${_basename}-${pkgver}/Documentation/licenses/COPYING.{BSD*,ISC} -t "$pkgdir/usr/share/licenses/$pkgname/"
    
      197  install -vDm 644 ${_basename}-BSD-2-Clause.txt -t "$pkgdir/usr/share/licenses/$pkgname/"
    
      198}
    
      199

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-26 21:30
@@ -8,7 +8,7 @@
 _basename=util-linux
 pkgbase=util-linux-aes
 pkgname=(util-linux-aes util-linux-libs-aes)
-_pkgmajor=2.41
+_pkgmajor=2.42
 _realver=${_pkgmajor}.2
 pkgver=${_realver/-/}
 pkgrel=1
@@ -48,15 +48,15 @@
         '60-rfkill.rules'
         'rfkill-unblock_.service'
         'rfkill-block_.service')
-sha256sums=('6062a1d89b571a61932e6fc0211f36060c4183568b81ee866cf363bce9f6583e'
+sha256sums=('03a05d3adf9602ef128f2da05b84b3205ce60c351e5737c0370f74000679ce8a'
             'SKIP'
             '6ffedbc0f7878612d2b23589f1ff2ab15633e1df7963a5d9fc750ec5500c7e7a'
-            'a3b107b08d005f24e558248f904327dee968b7e066c9074309613eab7067097d'
+            '49c158013141086912c22e8db72cb4a1a0ccb2204b4a8cb80dc3b9d48ef00cc7'
             'ee917d55042f78b8bb03f5467e5233e3e2ddc2fe01e302bc53b218003fe22275'
             '57e057758944f4557762c6def939410c04ca5803cbdd2bfa2153ce47ffe7a4af'
             '8bfbee453618ba44d60ba7fb00eced6c62edebfc592f2e75dede08e769ed8931'
             '48d6fba767631e3dd3620cf02a71a74c5d65a525d4c4ce4b5a0b7d9f41ebfea1'
-            '3f54249ac2db44945d6d12ec728dcd0d69af0735787a8b078eacd2c67e38155b'
+            '5f4d36be03cc980930ba0a0e109d6b5625201f88a4ae7f913d632f5ab5866b87'
             '10b0505351263a099163c0d928132706e501dd0a008dac2835b052167b14abe3'
             '7423aaaa09fee7f47baa83df9ea6fef525ff9aec395c8cbd9fe848ceb2643f37'
             '8ccec10a22523f6b9d55e0d6cbf91905a39881446710aa083e935e8073323376'
@@ -105,13 +105,14 @@
 
 package_util-linux-aes() {
   conflicts=('rfkill' 'hardlink' "${_basename}")
-  provides=('rfkill' 'hardlink' "${_basename}=2.40")
+  provides=('rfkill' 'hardlink' "${_basename}=2.42")
   replaces=('rfkill' 'hardlink')
   depends=("util-linux-libs-aes"
            'coreutils'
            'file' 'libmagic.so'
            'glibc'
            'libcap-ng'
+           'libgcc' 'libgcc_s.so'
            'libxcrypt' 'libcrypt.so'
            'ncurses' 'libncursesw.so'
            'pam'
@@ -181,7 +182,7 @@
   pkgdesc='util-linux runtime libraries updated with loop-aes'
   depends=('glibc'
            'sqlite')
-  provides=('libutil-linux' 'libblkid.so' 'libfdisk.so' 'libmount.so' 'libsmartcols.so' 'libuuid.so' "${_basename}-libs=2.40")
+  provides=('libutil-linux' 'libblkid.so' 'libfdisk.so' 'libmount.so' 'libsmartcols.so' 'libuuid.so' "${_basename}-libs=2.42")
   conflicts=('libutil-linux' "${_basename}-libs")
   replaces=('libutil-linux')
   optdepends=('python: python bindings to libmount')

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-26 21:30:41	Medium	1
2026-06-18 16:11:54	Clean	0