util-linux-libs-selinux
LOW
maintainer IooNag
17 votes
base
util-linux-selinux
scanned 2026-09-17 00:27:14.276658
Why flagged
The setuid binaries (chfn, chsh, newgrp) are standard system utilities being properly packaged with expected permissions, not malicious self-installation or privilege escalation.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The setuid binaries (chfn, chsh, newgrp) are standard system utilities being properly packaged with expected permissions, not malicious self-installation or privilege escalation.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
Privileged / out-of-pacman install (sudoers, setuid, or self-update)
privileged_install
The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.
-
PKGBUILD:169
chmod 4755 "${pkgdir}"/usr/bin/{newgrp,ch{sh,fn}}
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Tom Gundersen <teg@jklm.no>
2
# Maintainer: Dave Reisner <dreisner@archlinux.org>
3
# Contributor: judd <jvinet@zeroflux.org>
4
# SELinux Maintainer: Nicolas Iooss (nicolas <dot> iooss <at> m4x <dot> org)
5
# SELinux Contributor: Timothée Ravier <tim@siosm.fr>
6
# SELinux Contributor: Nicky726 <nicky726@gmail.com>
7
#
8
# This PKGBUILD is maintained on https://github.com/archlinuxhardened/selinux.
9
# If you want to help keep it up to date, please open a Pull Request there.
10
11
# ➡️ Pushing pre-releases to [core-testing] can cause havoc, especially
12
# as all [core] packages are built there, and may be moved before.
13
# Anyway, pre-release packages may be available in my personal testing
14
# repository. Brave souls add it with:
15
# [eworm-testing]
16
# SigLevel = Required
17
# Server = https://pkgbuild.com/~eworm/$repo/$arch/
18
19
pkgbase=util-linux-selinux
20
pkgname=(util-linux-selinux util-linux-libs-selinux)
21
pkgver=2.42.2
22
pkgrel=1
23
pkgdesc='SELinux aware miscellaneous system utilities for Linux'
24
url='https://github.com/util-linux/util-linux'
25
arch=('x86_64' 'aarch64')
26
groups=('selinux')
27
# SELinux package maintenance note:
28
# ArchLinux base packages have a build-time cyclic dependency because
29
# systemd depends on libutil-linux and util-linux depends on libudev
30
# provided by libsystemd (FS#39767). To break this cycle, make
31
# util-linux-selinux depend on systemd at build time.
32
makedepends=('asciidoctor'
33
'bash-completion'
34
'git'
35
'libcap-ng'
36
'libselinux'
37
'libxcrypt'
38
'meson'
39
'po4a'
40
'python'
41
'sqlite'
42
'systemd')
43
license=(
44
'BSD-2-Clause'
45
'BSD-3-Clause'
46
'BSD-4-Clause-UC'
47
'GPL-2.0-only'
48
'GPL-2.0-or-later'
49
'GPL-3.0-or-later'
50
'ISC'
51
'LGPL-2.1-or-later'
52
'LicenseRef-PublicDomain'
53
)
54
options=('strip')
55
validpgpkeys=('B0C64D14301CC6EFAEDF60E4E4B71D5EEC39C284') # Karel Zak
56
source=("git+https://github.com/util-linux/util-linux?signed#tag=v${pkgver/rc/-rc}"
57
${pkgbase/-selinux}-BSD-2-Clause.txt::https://raw.githubusercontent.com/Cyan4973/xxHash/f035303b8a86c1db9be70cbb638678ef6ef4cb2d/LICENSE
58
{login,common,remote,runuser,su}.pam
59
'util-linux.sysusers'
60
'60-rfkill.rules'
61
'rfkill-unblock_.service'
62
'rfkill-block_.service')
63
sha256sums=('b12ee0ba37ccaf6c88f767637a4519d5fdf76ddd1acbf7e6fc29e9eeeea30d8f'
64
'6ffedbc0f7878612d2b23589f1ff2ab15633e1df7963a5d9fc750ec5500c7e7a'
65
'ee917d55042f78b8bb03f5467e5233e3e2ddc2fe01e302bc53b218003fe22275'
66
'57e057758944f4557762c6def939410c04ca5803cbdd2bfa2153ce47ffe7a4af'
67
'8bfbee453618ba44d60ba7fb00eced6c62edebfc592f2e75dede08e769ed8931'
68
'48d6fba767631e3dd3620cf02a71a74c5d65a525d4c4ce4b5a0b7d9f41ebfea1'
69
'3f54249ac2db44945d6d12ec728dcd0d69af0735787a8b078eacd2c67e38155b'
70
'4a0b3dd8aa6d34dd29e1d153f396cacf908b0d64f7218276cbcab684587c0a0a'
71
'7423aaaa09fee7f47baa83df9ea6fef525ff9aec395c8cbd9fe848ceb2643f37'
72
'8ccec10a22523f6b9d55e0d6cbf91905a39881446710aa083e935e8073323376'
73
'a22e0a037e702170c7d88460cc9c9c2ab1d3e5c54a6985cd4a164ea7beff1b36')
74
75
_backports=(
76
)
77
78
_reverts=(
79
)
80
81
prepare() {
82
cd "${pkgbase/-selinux}"
83
84
local _c _l
85
for _c in "${_backports[@]}"; do
86
if [[ "${_c}" == *..* ]]; then _l='--reverse'; else _l='--max-count=1'; fi
87
git log --oneline "${_l}" "${_c}"
88
git cherry-pick --mainline 1 --no-commit "${_c}"
89
done
90
for _c in "${_reverts[@]}"; do
91
if [[ "${_c}" == *..* ]]; then _l='--reverse'; else _l='--max-count=1'; fi
92
git log --oneline "${_l}" "${_c}"
93
git revert --mainline 1 --no-commit "${_c}"
94
done
95
96
# do not mark dirty
97
sed -i '/dirty=/c dirty=' tools/git-version-gen
98
99
# Skip kill/decode, as it adds RT0 in an unexpected way
100
sed -i '/ts_skip_qemu_user/ ats_skip "Possible unexpected RT0 in output"' tests/ts/kill/decode
101
}
102
103
build() {
104
local _meson_options=(
105
-Dfs-search-path=/usr/bin:/usr/local/bin
106
107
-Dlibuser=disabled
108
-Dlibutempter=disabled
109
-Dncurses=disabled
110
-Dncursesw=enabled
111
-Deconf=disabled
112
-Dselinux=enabled
113
114
-Dbuild-chfn-chsh=enabled
115
-Dbuild-line=disabled
116
-Dbuild-mesg=enabled
117
-Dbuild-newgrp=enabled
118
-Dbuild-vipw=enabled
119
-Dbuild-write=enabled
120
)
121
122
arch-meson "${pkgbase/-selinux}" build "${_meson_options[@]}"
123
124
meson compile -C build
125
}
126
127
check() {
128
cd build
129
../util-linux/tests/run.sh --show-diff
130
}
131
132
package_util-linux-selinux() {
133
conflicts=('rfkill' 'hardlink'
134
"${pkgname/-selinux}" "selinux-${pkgname/-selinux}")
135
provides=('rfkill' 'hardlink'
136
"${pkgname/-selinux}=${pkgver}-${pkgrel}"
137
"selinux-${pkgname/-selinux}=${pkgver}-${pkgrel}")
138
depends=("util-linux-libs-selinux=${pkgver}"
139
'coreutils-selinux'
140
'file' 'libmagic.so'
141
'glibc'
142
'libcap-ng'
143
'libselinux' 'libselinux.so'
144
'libxcrypt' 'libcrypt.so'
145
'ncurses' 'libncursesw.so'
146
'pam-selinux'
147
'readline'
148
'shadow-selinux'
149
'systemd-libs' 'libsystemd.so' 'libudev.so'
150
'zlib')
151
optdepends=('words: default dictionary for look')
152
backup=(etc/pam.d/chfn
153
etc/pam.d/chsh
154
etc/pam.d/login
155
etc/pam.d/remote
156
etc/pam.d/runuser
157
etc/pam.d/runuser-l
158
etc/pam.d/su
159
etc/pam.d/su-l)
160
161
_python_stdlib="$(python -c 'import sysconfig; print(sysconfig.get_paths()["stdlib"])')"
162
163
DESTDIR="${pkgdir}" meson install -C build
164
165
# remove static libraries
166
rm "${pkgdir}"/usr/lib/lib*.a*
167
168
# setuid chfn and chsh
169
chmod 4755 "${pkgdir}"/usr/bin/{newgrp,ch{sh,fn}}
170
171
# install PAM files for login-utils
172
install -Dm0644 common.pam "${pkgdir}/etc/pam.d/chfn"
173
install -Dm0644 common.pam "${pkgdir}/etc/pam.d/chsh"
174
install -Dm0644 login.pam "${pkgdir}/etc/pam.d/login"
175
install -Dm0644 remote.pam "${pkgdir}/etc/pam.d/remote"
176
install -Dm0644 runuser.pam "${pkgdir}/etc/pam.d/runuser"
177
install -Dm0644 runuser.pam "${pkgdir}/etc/pam.d/runuser-l"
178
install -Dm0644 su.pam "${pkgdir}/etc/pam.d/su"
179
install -Dm0644 su.pam "${pkgdir}/etc/pam.d/su-l"
180
181
# TODO(dreisner): offer this upstream?
182
sed -i '/ListenStream/ aRuntimeDirectory=uuidd' "${pkgdir}/usr/lib/systemd/system/uuidd.socket"
183
184
# runtime libs are shipped as part of util-linux-libs
185
install -d -m0755 util-linux-libs/lib/
186
mv "$pkgdir"/usr/lib/lib*.so* util-linux-libs/lib/
187
mv "$pkgdir"/usr/lib/pkgconfig util-linux-libs/lib/pkgconfig
188
mv "$pkgdir"/usr/include util-linux-libs/include
189
mv "$pkgdir"/"${_python_stdlib}"/site-packages util-linux-libs/site-packages
190
rmdir "$pkgdir"/"${_python_stdlib}"
191
mv "$pkgdir"/usr/share/man/man3 util-linux-libs/man3
192
193
# install systemd-sysusers
194
install -Dm0644 util-linux.sysusers \
195
"${pkgdir}/usr/lib/sysusers.d/util-linux.conf"
196
197
install -Dm0644 60-rfkill.rules \
198
"${pkgdir}/usr/lib/udev/rules.d/60-rfkill.rules"
199
200
install -Dm0644 rfkill-unblock_.service \
201
"${pkgdir}/usr/lib/systemd/system/rfkill-unblock@.service"
202
install -Dm0644 rfkill-block_.service \
203
"${pkgdir}/usr/lib/systemd/system/rfkill-block@.service"
204
205
install -vDm 644 ${pkgbase/-selinux}/Documentation/licenses/COPYING.{BSD*,ISC} -t "$pkgdir/usr/share/licenses/$pkgname/"
206
install -vDm 644 ${pkgbase/-selinux}-BSD-2-Clause.txt -t "$pkgdir/usr/share/licenses/$pkgname/"
207
}
208
209
package_util-linux-libs-selinux() {
210
pkgdesc='util-linux-selinux runtime libraries'
211
depends=('glibc'
212
'libselinux'
213
'sqlite')
214
provides=('libutil-linux' 'libblkid.so' 'libfdisk.so' 'libmount.so' 'libsmartcols.so' 'libuuid.so'
215
"${pkgname/-selinux}=${pkgver}-${pkgrel}"
216
'libutil-linux-selinux')
217
conflicts=("${pkgname/-selinux}" 'libutil-linux-selinux')
218
replaces=('libutil-linux-selinux')
219
optdepends=('python: python bindings to libmount')
220
221
_python_stdlib="$(python -c 'import sysconfig; print(sysconfig.get_paths()["stdlib"])')"
222
223
install -d -m0755 "$pkgdir"/{"${_python_stdlib}",usr/share/man/}
224
mv util-linux-libs/lib/* "$pkgdir"/usr/lib/
225
mv util-linux-libs/include "$pkgdir"/usr/include
226
mv util-linux-libs/site-packages "$pkgdir"/"${_python_stdlib}"/site-packages
227
mv util-linux-libs/man3 "$pkgdir"/usr/share/man/man3
228
229
install -vDm 644 ${pkgbase/-selinux}/Documentation/licenses/COPYING.{BSD*,ISC} -t "$pkgdir/usr/share/licenses/$pkgname/"
230
install -vDm 644 ${pkgbase/-selinux}-BSD-2-Clause.txt -t "$pkgdir/usr/share/licenses/$pkgname/"
231
}
232
Changes since previous scan
--- PKGBUILD @ 2026-09-01 00:11+++ PKGBUILD @ 2026-09-17 00:27@@ -95,6 +95,9 @@ # do not mark dirty sed -i '/dirty=/c dirty=' tools/git-version-gen++ # Skip kill/decode, as it adds RT0 in an unexpected way+ sed -i '/ts_skip_qemu_user/ ats_skip "Possible unexpected RT0 in output"' tests/ts/kill/decode } build() {Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 19:49:11 | Medium | 1 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |