v2ray-rs
LOW
maintainer zhukva
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package installs setuid binaries and modifies system groups for legitimate TUN device access in a proxy tool, which is expected behavior for its functionality and not inherently malicious.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package installs setuid binaries and modifies system groups for legitimate TUN device access in a proxy tool, which is expected behavior for its functionality and not inherently malicious.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
Privileged / out-of-pacman install (sudoers, setuid, or self-update)
privileged_install
The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.
-
.install:15
chmod 4750 /usr/bin/v2ray-rs-run 2>/dev/null || true
PKGBUILD
1
pkgname=v2ray-rs
2
pkgver=0.18.0
3
pkgrel=1
4
pkgdesc="Linux desktop GUI for v2ray/xray/sing-box proxy management"
5
arch=('x86_64')
6
url="https://github.com/victorzhuk/v2ray-rs"
7
license=('Apache-2.0')
8
depends=('gtk4' 'libadwaita' 'dbus' 'libcap')
9
makedepends=('rust' 'cargo')
10
optdepends=(
11
'v2ray: V2Ray proxy backend'
12
'xray: Xray proxy backend'
13
'sing-box: sing-box proxy backend'
14
'polkit: one-time TUN privilege grant via pkexec'
15
)
16
install=v2ray-rs.install
17
source=("$pkgname-$pkgver.tar.gz::$url/archive/v$pkgver.tar.gz")
18
sha256sums=('45636b6319002f82869973acab1e162bb6e3330e8c53b662e33c43418dc80a3f')
19
20
prepare() {
21
cd "$pkgname-$pkgver"
22
export RUSTUP_TOOLCHAIN=stable
23
cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"
24
}
25
26
build() {
27
cd "$pkgname-$pkgver"
28
export RUSTUP_TOOLCHAIN=stable
29
export CARGO_TARGET_DIR=target
30
cargo build --frozen --release -p v2ray-rs-ui -p v2ray-rs-netctl -p v2ray-rs-run
31
}
32
33
package() {
34
cd "$pkgname-$pkgver"
35
install -Dm755 "target/release/v2ray-rs-ui" "$pkgdir/usr/bin/v2ray-rs"
36
# Privileged TUN helpers. The install hook creates the `v2ray-rs` group,
37
# restricts these to it (netctl 0750 + cap_net_admin, run 4750 setuid), and
38
# creates the bypass user. Modes here are the pre-hook defaults.
39
install -Dm755 "target/release/v2ray-rs-netctl" "$pkgdir/usr/bin/v2ray-rs-netctl"
40
install -Dm4755 "target/release/v2ray-rs-run" "$pkgdir/usr/bin/v2ray-rs-run"
41
install_icon "assets/v2ray-rs.svg" \
42
"crates/ui/icons/hicolor/scalable/apps/com.github.v2ray-rs.svg" \
43
"$pkgdir/usr/share/icons/hicolor/scalable/apps/com.github.v2ray-rs.svg"
44
install_optional "assets/v2ray-rs.png" \
45
"$pkgdir/usr/share/icons/hicolor/256x256/apps/com.github.v2ray-rs.png"
46
install_icon "crates/ui/icons/hicolor/symbolic/apps/com.github.v2ray-rs-symbolic.svg" \
47
"assets/v2ray-rs-symbolic.svg" \
48
"$pkgdir/usr/share/icons/hicolor/symbolic/apps/com.github.v2ray-rs-symbolic.svg"
49
install_icon "assets/com.github.v2ray-rs.desktop" \
50
"crates/ui/assets/com.github.v2ray-rs.desktop" \
51
"$pkgdir/usr/share/applications/com.github.v2ray-rs.desktop"
52
local lang
53
for lang in en_US ru_RU; do
54
install -Dm644 "locale/$lang/LC_MESSAGES/v2ray-rs.mo" \
55
"$pkgdir/usr/share/locale/$lang/LC_MESSAGES/v2ray-rs.mo"
56
done
57
install -Dm644 "LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
58
}
59
60
install_icon() {
61
local primary=$1
62
local fallback=$2
63
local dest=$3
64
65
if [[ -f "$primary" ]]; then
66
install -Dm644 "$primary" "$dest"
67
return
68
fi
69
70
if [[ -f "$fallback" ]]; then
71
install -Dm644 "$fallback" "$dest"
72
return
73
fi
74
75
echo "Missing icon asset: $primary or $fallback" >&2
76
return 1
77
}
78
79
install_optional() {
80
local src=$1
81
local dest=$2
82
83
if [[ -f "$src" ]]; then
84
install -Dm644 "$src" "$dest"
85
fi
86
}
87
Changes since previous scan
--- PKGBUILD @ 2026-09-12 00:25+++ PKGBUILD @ 2026-09-17 00:27@@ -1,5 +1,5 @@ pkgname=v2ray-rs-pkgver=0.17.3+pkgver=0.18.0 pkgrel=1 pkgdesc="Linux desktop GUI for v2ray/xray/sing-box proxy management" arch=('x86_64')@@ -15,7 +15,7 @@ ) install=v2ray-rs.install source=("$pkgname-$pkgver.tar.gz::$url/archive/v$pkgver.tar.gz")-sha256sums=('53c4cc8b17cfd424742bbb70e5598025c26bcba5c442b2c95236384a7282f997')+sha256sums=('45636b6319002f82869973acab1e162bb6e3330e8c53b662e33c43418dc80a3f') prepare() { cd "$pkgname-$pkgver"Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 13:12:15 | Medium | 1 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 05:56:41 | Medium | 1 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 19:54:21 | Medium | 1 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |