v2ray-rs

LOW

maintainer zhukva 0 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package installs setuid binaries and modifies groups for privilege separation, which is a privileged operation, but it is done transparently for legitimate functionality (TUN interface management) and follows common practices for such tools.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package installs setuid binaries and modifies groups for privilege separation, which is a privileged operation, but it is done transparently for legitimate functionality (TUN interface management) and follows common practices for such tools.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

.install:15 chmod 4750 /usr/bin/v2ray-rs-run 2>/dev/null || true

PKGBUILD

      1pkgname=v2ray-rs
    
      2pkgver=0.20.2
    
      3pkgrel=1
    
      4pkgdesc="Linux desktop GUI for v2ray/xray/sing-box proxy management"
    
      5arch=('x86_64')
    
      6url="https://github.com/victorzhuk/v2ray-rs"
    
      7license=('Apache-2.0')
    
      8depends=('gtk4' 'libadwaita' 'dbus' 'libcap')
    
      9makedepends=('rust' 'cargo')
    
      10optdepends=(
    
      11    'v2ray: V2Ray proxy backend'
    
      12    'xray: Xray proxy backend'
    
      13    'sing-box: sing-box proxy backend'
    
      14    'polkit: one-time TUN privilege grant via pkexec'
    
      15)
    
      16install=v2ray-rs.install
    
      17source=("$pkgname-$pkgver.tar.gz::$url/archive/v$pkgver.tar.gz")
    
      18sha256sums=('d8167fd74ee15155aa05e05de63da480d94c37cb7a65ad96139a2ab6a4ac6c44')
    
      19
    
      20prepare() {
    
      21    cd "$pkgname-$pkgver"
    
      22    export RUSTUP_TOOLCHAIN=stable
    
      23    cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"
    
      24}
    
      25
    
      26build() {
    
      27    cd "$pkgname-$pkgver"
    
      28    export RUSTUP_TOOLCHAIN=stable
    
      29    export CARGO_TARGET_DIR=target
    
      30    cargo build --frozen --release -p v2ray-rs-ui -p v2ray-rs-netctl -p v2ray-rs-run
    
      31}
    
      32
    
      33package() {
    
      34    cd "$pkgname-$pkgver"
    
      35    install -Dm755 "target/release/v2ray-rs-ui" "$pkgdir/usr/bin/v2ray-rs"
    
      36    # Privileged TUN helpers. The install hook creates the `v2ray-rs` group,
    
      37    # restricts these to it (netctl 0750 + cap_net_admin, run 4750 setuid), and
    
      38    # creates the bypass user. Modes here are the pre-hook defaults.
    
      39    install -Dm755 "target/release/v2ray-rs-netctl" "$pkgdir/usr/bin/v2ray-rs-netctl"
    
      40    install -Dm4755 "target/release/v2ray-rs-run" "$pkgdir/usr/bin/v2ray-rs-run"
    
      41    install_icon "assets/v2ray-rs.svg" \
    
      42        "crates/ui/icons/hicolor/scalable/apps/com.github.v2ray-rs.svg" \
    
      43        "$pkgdir/usr/share/icons/hicolor/scalable/apps/com.github.v2ray-rs.svg"
    
      44    install_optional "assets/v2ray-rs.png" \
    
      45        "$pkgdir/usr/share/icons/hicolor/256x256/apps/com.github.v2ray-rs.png"
    
      46    install_icon "crates/ui/icons/hicolor/symbolic/apps/com.github.v2ray-rs-symbolic.svg" \
    
      47        "assets/v2ray-rs-symbolic.svg" \
    
      48        "$pkgdir/usr/share/icons/hicolor/symbolic/apps/com.github.v2ray-rs-symbolic.svg"
    
      49    install_icon "assets/com.github.v2ray-rs.desktop" \
    
      50        "crates/ui/assets/com.github.v2ray-rs.desktop" \
    
      51        "$pkgdir/usr/share/applications/com.github.v2ray-rs.desktop"
    
      52    local lang
    
      53    for lang in en_US ru_RU; do
    
      54        install -Dm644 "locale/$lang/LC_MESSAGES/v2ray-rs.mo" \
    
      55            "$pkgdir/usr/share/locale/$lang/LC_MESSAGES/v2ray-rs.mo"
    
      56    done
    
      57    install -Dm644 "LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      58}
    
      59
    
      60install_icon() {
    
      61    local primary=$1
    
      62    local fallback=$2
    
      63    local dest=$3
    
      64
    
      65    if [[ -f "$primary" ]]; then
    
      66        install -Dm644 "$primary" "$dest"
    
      67        return
    
      68    fi
    
      69
    
      70    if [[ -f "$fallback" ]]; then
    
      71        install -Dm644 "$fallback" "$dest"
    
      72        return
    
      73    fi
    
      74
    
      75    echo "Missing icon asset: $primary or $fallback" >&2
    
      76    return 1
    
      77}
    
      78
    
      79install_optional() {
    
      80    local src=$1
    
      81    local dest=$2
    
      82
    
      83    if [[ -f "$src" ]]; then
    
      84        install -Dm644 "$src" "$dest"
    
      85    fi
    
      86}
    
      87

Changes since previous scan

--- PKGBUILD @ 2026-10-18 00:06
+++ PKGBUILD @ 2026-11-01 00:21
@@ -1,5 +1,5 @@
 pkgname=v2ray-rs
-pkgver=0.20.1
+pkgver=0.20.2
 pkgrel=1
 pkgdesc="Linux desktop GUI for v2ray/xray/sing-box proxy management"
 arch=('x86_64')
@@ -15,7 +15,7 @@
 )
 install=v2ray-rs.install
 source=("$pkgname-$pkgver.tar.gz::$url/archive/v$pkgver.tar.gz")
-sha256sums=('01c2729c14e4bf4ad54ce68241f92265da0c49f6058b63f546e02a8c04e040dd')
+sha256sums=('d8167fd74ee15155aa05e05de63da480d94c37cb7a65ad96139a2ab6a4ac6c44')
 
 prepare() {
     cd "$pkgname-$pkgver"

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 09:21:55	Medium	1
2026-10-18 00:06:55	Low	2
2026-10-17 19:19:13	Medium	1
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2