util-linux-libs-selinux

maintainer IooNag · 17 votes · base util-linux-selinux · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The setuid binaries (chfn, chsh, newgrp) are legitimately required for their functionality and are standard in util-linux packages; this is a normal, expected configuration, not malicious privilege escalation.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The setuid binaries (chfn, chsh, newgrp) are legitimately required for their functionality and are standard in util-linux packages; this is a normal, expected configuration, not malicious privilege escalation.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

PKGBUILD:166 chmod 4755 "${pkgdir}"/usr/bin/{newgrp,ch{sh,fn}}

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Tom Gundersen <teg@jklm.no>
    
      2# Maintainer: Dave Reisner <dreisner@archlinux.org>
    
      3# Contributor: judd <jvinet@zeroflux.org>
    
      4# SELinux Maintainer: Nicolas Iooss (nicolas <dot> iooss <at> m4x <dot> org)
    
      5# SELinux Contributor: Timothée Ravier <tim@siosm.fr>
    
      6# SELinux Contributor: Nicky726 <nicky726@gmail.com>
    
      7#
    
      8# This PKGBUILD is maintained on https://github.com/archlinuxhardened/selinux.
    
      9# If you want to help keep it up to date, please open a Pull Request there.
    
      10
    
      11# ➡️ Pushing pre-releases to [core-testing] can cause havoc, especially
    
      12#   as all [core] packages are built there, and may be moved before.
    
      13#   Anyway, pre-release packages may be available in my personal testing
    
      14#   repository. Brave souls add it with:
    
      15#     [eworm-testing]
    
      16#     SigLevel = Required
    
      17#     Server = https://pkgbuild.com/~eworm/$repo/$arch/
    
      18
    
      19pkgbase=util-linux-selinux
    
      20pkgname=(util-linux-selinux util-linux-libs-selinux)
    
      21pkgver=2.42.2
    
      22pkgrel=1
    
      23pkgdesc='SELinux aware miscellaneous system utilities for Linux'
    
      24url='https://github.com/util-linux/util-linux'
    
      25arch=('x86_64' 'aarch64')
    
      26groups=('selinux')
    
      27# SELinux package maintenance note:
    
      28#   ArchLinux base packages have a build-time cyclic dependency because
    
      29#   systemd depends on libutil-linux and util-linux depends on libudev
    
      30#   provided by libsystemd (FS#39767).  To break this cycle, make
    
      31#   util-linux-selinux depend on systemd at build time.
    
      32makedepends=('asciidoctor'
    
      33             'bash-completion'
    
      34             'git'
    
      35             'libcap-ng'
    
      36             'libselinux'
    
      37             'libxcrypt'
    
      38             'meson'
    
      39             'po4a'
    
      40             'python'
    
      41             'sqlite'
    
      42             'systemd')
    
      43license=(
    
      44  'BSD-2-Clause'
    
      45  'BSD-3-Clause'
    
      46  'BSD-4-Clause-UC'
    
      47  'GPL-2.0-only'
    
      48  'GPL-2.0-or-later'
    
      49  'GPL-3.0-or-later'
    
      50  'ISC'
    
      51  'LGPL-2.1-or-later'
    
      52  'LicenseRef-PublicDomain'
    
      53)
    
      54options=('strip')
    
      55validpgpkeys=('B0C64D14301CC6EFAEDF60E4E4B71D5EEC39C284')  # Karel Zak
    
      56source=("git+https://github.com/util-linux/util-linux?signed#tag=v${pkgver/rc/-rc}"
    
      57        ${pkgbase/-selinux}-BSD-2-Clause.txt::https://raw.githubusercontent.com/Cyan4973/xxHash/f035303b8a86c1db9be70cbb638678ef6ef4cb2d/LICENSE
    
      58        {login,common,remote,runuser,su}.pam
    
      59        'util-linux.sysusers'
    
      60        '60-rfkill.rules'
    
      61        'rfkill-unblock_.service'
    
      62        'rfkill-block_.service')
    
      63sha256sums=('b12ee0ba37ccaf6c88f767637a4519d5fdf76ddd1acbf7e6fc29e9eeeea30d8f'
    
      64            '6ffedbc0f7878612d2b23589f1ff2ab15633e1df7963a5d9fc750ec5500c7e7a'
    
      65            'ee917d55042f78b8bb03f5467e5233e3e2ddc2fe01e302bc53b218003fe22275'
    
      66            '57e057758944f4557762c6def939410c04ca5803cbdd2bfa2153ce47ffe7a4af'
    
      67            '8bfbee453618ba44d60ba7fb00eced6c62edebfc592f2e75dede08e769ed8931'
    
      68            '48d6fba767631e3dd3620cf02a71a74c5d65a525d4c4ce4b5a0b7d9f41ebfea1'
    
      69            '3f54249ac2db44945d6d12ec728dcd0d69af0735787a8b078eacd2c67e38155b'
    
      70            '4a0b3dd8aa6d34dd29e1d153f396cacf908b0d64f7218276cbcab684587c0a0a'
    
      71            '7423aaaa09fee7f47baa83df9ea6fef525ff9aec395c8cbd9fe848ceb2643f37'
    
      72            '8ccec10a22523f6b9d55e0d6cbf91905a39881446710aa083e935e8073323376'
    
      73            'a22e0a037e702170c7d88460cc9c9c2ab1d3e5c54a6985cd4a164ea7beff1b36')
    
      74
    
      75_backports=(
    
      76)
    
      77
    
      78_reverts=(
    
      79)
    
      80
    
      81prepare() {
    
      82  cd "${pkgbase/-selinux}"
    
      83
    
      84  local _c _l
    
      85  for _c in "${_backports[@]}"; do
    
      86    if [[ "${_c}" == *..* ]]; then _l='--reverse'; else _l='--max-count=1'; fi
    
      87    git log --oneline "${_l}" "${_c}"
    
      88    git cherry-pick --mainline 1 --no-commit "${_c}"
    
      89  done
    
      90  for _c in "${_reverts[@]}"; do
    
      91    if [[ "${_c}" == *..* ]]; then _l='--reverse'; else _l='--max-count=1'; fi
    
      92    git log --oneline "${_l}" "${_c}"
    
      93    git revert --mainline 1 --no-commit "${_c}"
    
      94  done
    
      95
    
      96  # do not mark dirty
    
      97  sed -i '/dirty=/c dirty=' tools/git-version-gen
    
      98}
    
      99
    
      100build() {
    
      101  local _meson_options=(
    
      102    -Dfs-search-path=/usr/bin:/usr/local/bin
    
      103
    
      104    -Dlibuser=disabled
    
      105    -Dlibutempter=disabled
    
      106    -Dncurses=disabled
    
      107    -Dncursesw=enabled
    
      108    -Deconf=disabled
    
      109    -Dselinux=enabled
    
      110
    
      111    -Dbuild-chfn-chsh=enabled
    
      112    -Dbuild-line=disabled
    
      113    -Dbuild-mesg=enabled
    
      114    -Dbuild-newgrp=enabled
    
      115    -Dbuild-vipw=enabled
    
      116    -Dbuild-write=enabled
    
      117  )
    
      118
    
      119  arch-meson "${pkgbase/-selinux}" build "${_meson_options[@]}"
    
      120
    
      121  meson compile -C build
    
      122}
    
      123
    
      124check() {
    
      125  cd build
    
      126  ../util-linux/tests/run.sh --show-diff
    
      127}
    
      128
    
      129package_util-linux-selinux() {
    
      130  conflicts=('rfkill' 'hardlink'
    
      131             "${pkgname/-selinux}" "selinux-${pkgname/-selinux}")
    
      132  provides=('rfkill' 'hardlink'
    
      133            "${pkgname/-selinux}=${pkgver}-${pkgrel}"
    
      134            "selinux-${pkgname/-selinux}=${pkgver}-${pkgrel}")
    
      135  depends=("util-linux-libs-selinux=${pkgver}"
    
      136           'coreutils-selinux'
    
      137           'file' 'libmagic.so'
    
      138           'glibc'
    
      139           'libcap-ng'
    
      140           'libselinux' 'libselinux.so'
    
      141           'libxcrypt' 'libcrypt.so'
    
      142           'ncurses' 'libncursesw.so'
    
      143           'pam-selinux'
    
      144           'readline'
    
      145           'shadow-selinux'
    
      146           'systemd-libs' 'libsystemd.so' 'libudev.so'
    
      147           'zlib')
    
      148  optdepends=('words: default dictionary for look')
    
      149  backup=(etc/pam.d/chfn
    
      150          etc/pam.d/chsh
    
      151          etc/pam.d/login
    
      152          etc/pam.d/remote
    
      153          etc/pam.d/runuser
    
      154          etc/pam.d/runuser-l
    
      155          etc/pam.d/su
    
      156          etc/pam.d/su-l)
    
      157
    
      158  _python_stdlib="$(python -c 'import sysconfig; print(sysconfig.get_paths()["stdlib"])')"
    
      159
    
      160  DESTDIR="${pkgdir}" meson install -C build
    
      161
    
      162  # remove static libraries
    
      163  rm "${pkgdir}"/usr/lib/lib*.a*
    
      164
    
      165  # setuid chfn and chsh
    
      166  chmod 4755 "${pkgdir}"/usr/bin/{newgrp,ch{sh,fn}}
    
      167
    
      168  # install PAM files for login-utils
    
      169  install -Dm0644 common.pam "${pkgdir}/etc/pam.d/chfn"
    
      170  install -Dm0644 common.pam "${pkgdir}/etc/pam.d/chsh"
    
      171  install -Dm0644 login.pam "${pkgdir}/etc/pam.d/login"
    
      172  install -Dm0644 remote.pam "${pkgdir}/etc/pam.d/remote"
    
      173  install -Dm0644 runuser.pam "${pkgdir}/etc/pam.d/runuser"
    
      174  install -Dm0644 runuser.pam "${pkgdir}/etc/pam.d/runuser-l"
    
      175  install -Dm0644 su.pam "${pkgdir}/etc/pam.d/su"
    
      176  install -Dm0644 su.pam "${pkgdir}/etc/pam.d/su-l"
    
      177
    
      178  # TODO(dreisner): offer this upstream?
    
      179  sed -i '/ListenStream/ aRuntimeDirectory=uuidd' "${pkgdir}/usr/lib/systemd/system/uuidd.socket"
    
      180
    
      181  # runtime libs are shipped as part of util-linux-libs
    
      182  install -d -m0755 util-linux-libs/lib/
    
      183  mv "$pkgdir"/usr/lib/lib*.so* util-linux-libs/lib/
    
      184  mv "$pkgdir"/usr/lib/pkgconfig util-linux-libs/lib/pkgconfig
    
      185  mv "$pkgdir"/usr/include util-linux-libs/include
    
      186  mv "$pkgdir"/"${_python_stdlib}"/site-packages util-linux-libs/site-packages
    
      187  rmdir "$pkgdir"/"${_python_stdlib}"
    
      188  mv "$pkgdir"/usr/share/man/man3 util-linux-libs/man3
    
      189
    
      190  # install systemd-sysusers
    
      191  install -Dm0644 util-linux.sysusers \
    
      192    "${pkgdir}/usr/lib/sysusers.d/util-linux.conf"
    
      193
    
      194  install -Dm0644 60-rfkill.rules \
    
      195    "${pkgdir}/usr/lib/udev/rules.d/60-rfkill.rules"
    
      196
    
      197  install -Dm0644 rfkill-unblock_.service \
    
      198    "${pkgdir}/usr/lib/systemd/system/rfkill-unblock@.service"
    
      199  install -Dm0644 rfkill-block_.service \
    
      200    "${pkgdir}/usr/lib/systemd/system/rfkill-block@.service"
    
      201
    
      202  install -vDm 644 ${pkgbase/-selinux}/Documentation/licenses/COPYING.{BSD*,ISC} -t "$pkgdir/usr/share/licenses/$pkgname/"
    
      203  install -vDm 644 ${pkgbase/-selinux}-BSD-2-Clause.txt -t "$pkgdir/usr/share/licenses/$pkgname/"
    
      204}
    
      205
    
      206package_util-linux-libs-selinux() {
    
      207  pkgdesc='util-linux-selinux runtime libraries'
    
      208  depends=('glibc'
    
      209           'libselinux'
    
      210           'sqlite')
    
      211  provides=('libutil-linux' 'libblkid.so' 'libfdisk.so' 'libmount.so' 'libsmartcols.so' 'libuuid.so'
    
      212            "${pkgname/-selinux}=${pkgver}-${pkgrel}"
    
      213            'libutil-linux-selinux')
    
      214  conflicts=("${pkgname/-selinux}" 'libutil-linux-selinux')
    
      215  replaces=('libutil-linux-selinux')
    
      216  optdepends=('python: python bindings to libmount')
    
      217
    
      218  _python_stdlib="$(python -c 'import sysconfig; print(sysconfig.get_paths()["stdlib"])')"
    
      219
    
      220  install -d -m0755 "$pkgdir"/{"${_python_stdlib}",usr/share/man/}
    
      221  mv util-linux-libs/lib/* "$pkgdir"/usr/lib/
    
      222  mv util-linux-libs/include "$pkgdir"/usr/include
    
      223  mv util-linux-libs/site-packages "$pkgdir"/"${_python_stdlib}"/site-packages
    
      224  mv util-linux-libs/man3 "$pkgdir"/usr/share/man/man3
    
      225
    
      226  install -vDm 644 ${pkgbase/-selinux}/Documentation/licenses/COPYING.{BSD*,ISC} -t "$pkgdir/usr/share/licenses/$pkgname/"
    
      227  install -vDm 644 ${pkgbase/-selinux}-BSD-2-Clause.txt -t "$pkgdir/usr/share/licenses/$pkgname/"
    
      228}
    
      229

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -18,8 +18,8 @@
 
 pkgbase=util-linux-selinux
 pkgname=(util-linux-selinux util-linux-libs-selinux)
-pkgver=2.41.3
-pkgrel=2
+pkgver=2.42.2
+pkgrel=1
 pkgdesc='SELinux aware miscellaneous system utilities for Linux'
 url='https://github.com/util-linux/util-linux'
 arch=('x86_64' 'aarch64')
@@ -53,14 +53,14 @@
 )
 options=('strip')
 validpgpkeys=('B0C64D14301CC6EFAEDF60E4E4B71D5EEC39C284')  # Karel Zak
-source=("git+https://github.com/util-linux/util-linux#tag=v${pkgver/rc/-rc}?signed"
+source=("git+https://github.com/util-linux/util-linux?signed#tag=v${pkgver/rc/-rc}"
         ${pkgbase/-selinux}-BSD-2-Clause.txt::https://raw.githubusercontent.com/Cyan4973/xxHash/f035303b8a86c1db9be70cbb638678ef6ef4cb2d/LICENSE
         {login,common,remote,runuser,su}.pam
         'util-linux.sysusers'
         '60-rfkill.rules'
         'rfkill-unblock_.service'
         'rfkill-block_.service')
-sha256sums=('d95e1a90d4a0733372f46c4af4fbb6fe7667d96b800c46a0cc05c5abe699eabe'
+sha256sums=('b12ee0ba37ccaf6c88f767637a4519d5fdf76ddd1acbf7e6fc29e9eeeea30d8f'
             '6ffedbc0f7878612d2b23589f1ff2ab15633e1df7963a5d9fc750ec5500c7e7a'
             'ee917d55042f78b8bb03f5467e5233e3e2ddc2fe01e302bc53b218003fe22275'
             '57e057758944f4557762c6def939410c04ca5803cbdd2bfa2153ce47ffe7a4af'
@@ -93,9 +93,6 @@
     git revert --mainline 1 --no-commit "${_c}"
   done
 
-  # create fully locked system accout
-  sed -i '/^u /s|u|u!|' misc-utils/uuidd-sysusers.conf.in
-
   # do not mark dirty
   sed -i '/dirty=/c dirty=' tools/git-version-gen
 }
@@ -122,6 +119,11 @@
   arch-meson "${pkgbase/-selinux}" build "${_meson_options[@]}"
 
   meson compile -C build
+}
+
+check() {
+  cd build
+  ../util-linux/tests/run.sh --show-diff
 }
 
 package_util-linux-selinux() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 21:18:45	MEDIUM	1
2026-06-18 16:11:54	CLEAN	0