v2ray-rs

maintainer zhukva · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package installs setuid binaries and modifies system groups for privilege management, but this is a legitimate requirement for TUN-based networking; the actions are transparent, self-contained, and intended for local privilege separation, not malicious access.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package installs setuid binaries and modifies system groups for privilege management, but this is a legitimate requirement for TUN-based networking; the actions are transparent, self-contained, and intended for local privilege separation, not malicious access.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

.install:15 chmod 4750 /usr/bin/v2ray-rs-run 2>/dev/null || true

PKGBUILD

      1pkgname=v2ray-rs
    
      2pkgver=0.14.0
    
      3pkgrel=1
    
      4pkgdesc="Linux desktop GUI for v2ray/xray/sing-box proxy management"
    
      5arch=('x86_64')
    
      6url="https://github.com/victorzhuk/v2ray-rs"
    
      7license=('Apache-2.0')
    
      8depends=('gtk4' 'libadwaita' 'dbus' 'libcap')
    
      9makedepends=('rust' 'cargo')
    
      10optdepends=(
    
      11    'v2ray: V2Ray proxy backend'
    
      12    'xray: Xray proxy backend'
    
      13    'sing-box: sing-box proxy backend'
    
      14    'polkit: one-time TUN privilege grant via pkexec'
    
      15)
    
      16options=(!lto)
    
      17install=v2ray-rs.install
    
      18source=("$pkgname-$pkgver.tar.gz::$url/archive/v$pkgver.tar.gz")
    
      19sha256sums=('850a5ce130494b3a62bcc4c6981fccc82c03f2e93ebd37cd3ad3f64c189202c9')
    
      20
    
      21prepare() {
    
      22    cd "$pkgname-$pkgver"
    
      23    export RUSTUP_TOOLCHAIN=stable
    
      24    cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"
    
      25}
    
      26
    
      27build() {
    
      28    cd "$pkgname-$pkgver"
    
      29    export RUSTUP_TOOLCHAIN=stable
    
      30    export CARGO_TARGET_DIR=target
    
      31    cargo build --frozen --release -p v2ray-rs-ui -p v2ray-rs-netctl -p v2ray-rs-run
    
      32}
    
      33
    
      34package() {
    
      35    cd "$pkgname-$pkgver"
    
      36    install -Dm755 "target/release/v2ray-rs-ui" "$pkgdir/usr/bin/v2ray-rs"
    
      37    # Privileged TUN helpers. The install hook creates the `v2ray-rs` group,
    
      38    # restricts these to it (netctl 0750 + cap_net_admin, run 4750 setuid), and
    
      39    # creates the bypass user. Modes here are the pre-hook defaults.
    
      40    install -Dm755 "target/release/v2ray-rs-netctl" "$pkgdir/usr/bin/v2ray-rs-netctl"
    
      41    install -Dm4755 "target/release/v2ray-rs-run" "$pkgdir/usr/bin/v2ray-rs-run"
    
      42    install_icon "assets/v2ray-rs.svg" \
    
      43        "crates/ui/icons/hicolor/scalable/apps/com.github.v2ray-rs.svg" \
    
      44        "$pkgdir/usr/share/icons/hicolor/scalable/apps/com.github.v2ray-rs.svg"
    
      45    install_optional "assets/v2ray-rs.png" \
    
      46        "$pkgdir/usr/share/icons/hicolor/256x256/apps/com.github.v2ray-rs.png"
    
      47    install_icon "crates/ui/icons/hicolor/symbolic/apps/com.github.v2ray-rs-symbolic.svg" \
    
      48        "assets/v2ray-rs-symbolic.svg" \
    
      49        "$pkgdir/usr/share/icons/hicolor/symbolic/apps/com.github.v2ray-rs-symbolic.svg"
    
      50    install_icon "assets/com.github.v2ray-rs.desktop" \
    
      51        "crates/ui/assets/com.github.v2ray-rs.desktop" \
    
      52        "$pkgdir/usr/share/applications/com.github.v2ray-rs.desktop"
    
      53    install -Dm644 "LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      54}
    
      55
    
      56install_icon() {
    
      57    local primary=$1
    
      58    local fallback=$2
    
      59    local dest=$3
    
      60
    
      61    if [[ -f "$primary" ]]; then
    
      62        install -Dm644 "$primary" "$dest"
    
      63        return
    
      64    fi
    
      65
    
      66    if [[ -f "$fallback" ]]; then
    
      67        install -Dm644 "$fallback" "$dest"
    
      68        return
    
      69    fi
    
      70
    
      71    echo "Missing icon asset: $primary or $fallback" >&2
    
      72    return 1
    
      73}
    
      74
    
      75install_optional() {
    
      76    local src=$1
    
      77    local dest=$2
    
      78
    
      79    if [[ -f "$src" ]]; then
    
      80        install -Dm644 "$src" "$dest"
    
      81    fi
    
      82}
    
      83

Changes since previous scan

--- PKGBUILD @ 2026-07-19 00:17
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,5 +1,5 @@
 pkgname=v2ray-rs
-pkgver=0.13.0
+pkgver=0.14.0
 pkgrel=1
 pkgdesc="Linux desktop GUI for v2ray/xray/sing-box proxy management"
 arch=('x86_64')
@@ -16,7 +16,7 @@
 options=(!lto)
 install=v2ray-rs.install
 source=("$pkgname-$pkgver.tar.gz::$url/archive/v$pkgver.tar.gz")
-sha256sums=('261e10fb26465d04fe04f49ab93bdffd37bf7c0fb20c620b6fdc0b40f24cec4a')
+sha256sums=('850a5ce130494b3a62bcc4c6981fccc82c03f2e93ebd37cd3ad3f64c189202c9')
 
 prepare() {
     cd "$pkgname-$pkgver"

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 17:11:42	MEDIUM	1
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2