v2ray-rs-bin

LOW

maintainer zhukva 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The package installs setuid binaries and modifies system groups for privilege management, but this is part of legitimate TUN device setup for a proxy GUI and is handled safely via group restrictions and capabilities; no remote code execution or malicious behavior is present.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package installs setuid binaries and modifies system groups for privilege management, but this is part of legitimate TUN device setup for a proxy GUI and is handled safely via group restrictions and capabilities; no remote code execution or malicious behavior is present.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

.install:15 chmod 4750 /usr/bin/v2ray-rs-run 2>/dev/null || true

PKGBUILD

      1pkgname=v2ray-rs-bin
    
      2_pkgname=v2ray-rs
    
      3pkgver=0.20.0
    
      4pkgrel=1
    
      5pkgdesc="Linux desktop GUI for v2ray/xray/sing-box proxy management (prebuilt)"
    
      6arch=('x86_64')
    
      7url="https://github.com/victorzhuk/v2ray-rs"
    
      8license=('Apache-2.0')
    
      9depends=('gtk4' 'libadwaita' 'dbus' 'libcap')
    
      10provides=("$_pkgname=$pkgver")
    
      11conflicts=("$_pkgname")
    
      12optdepends=(
    
      13    'v2ray: V2Ray proxy backend'
    
      14    'xray: Xray proxy backend'
    
      15    'sing-box: sing-box proxy backend'
    
      16    'polkit: one-time TUN privilege grant via pkexec'
    
      17)
    
      18install=v2ray-rs.install
    
      19source=("$pkgname-$pkgver.tar.gz::$url/releases/download/v$pkgver/v2ray-rs-$CARCH-linux.tar.gz")
    
      20sha256sums=('1b74bc36981aba52a17c8003f0dcfc4559f953125a6f9712a9541ae8e4d83266')
    
      21
    
      22package() {
    
      23    cd "$_pkgname-$pkgver-$CARCH-linux"
    
      24
    
      25    install -Dm755 "bin/v2ray-rs" "$pkgdir/usr/bin/v2ray-rs"
    
      26    # Privileged TUN helpers. The install hook creates the `v2ray-rs` group,
    
      27    # restricts these to it (netctl 0750 + cap_net_admin, run 4750 setuid), and
    
      28    # creates the bypass user. Modes here are the pre-hook defaults.
    
      29    install -Dm755 "bin/v2ray-rs-netctl" "$pkgdir/usr/bin/v2ray-rs-netctl"
    
      30    install -Dm4755 "bin/v2ray-rs-run" "$pkgdir/usr/bin/v2ray-rs-run"
    
      31
    
      32    install -Dm644 "share/applications/com.github.v2ray-rs.desktop" \
    
      33        "$pkgdir/usr/share/applications/com.github.v2ray-rs.desktop"
    
      34    install -Dm644 "share/icons/hicolor/scalable/apps/com.github.v2ray-rs.svg" \
    
      35        "$pkgdir/usr/share/icons/hicolor/scalable/apps/com.github.v2ray-rs.svg"
    
      36    install -Dm644 "share/icons/hicolor/symbolic/apps/com.github.v2ray-rs-symbolic.svg" \
    
      37        "$pkgdir/usr/share/icons/hicolor/symbolic/apps/com.github.v2ray-rs-symbolic.svg"
    
      38    install -Dm644 "share/icons/hicolor/256x256/apps/com.github.v2ray-rs.png" \
    
      39        "$pkgdir/usr/share/icons/hicolor/256x256/apps/com.github.v2ray-rs.png"
    
      40
    
      41    local lang
    
      42    for lang in en_US ru_RU; do
    
      43        install -Dm644 "share/locale/$lang/LC_MESSAGES/v2ray-rs.mo" \
    
      44            "$pkgdir/usr/share/locale/$lang/LC_MESSAGES/v2ray-rs.mo"
    
      45    done
    
      46
    
      47    install -Dm644 "LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      48}
    
      49

Changes since previous scan

--- PKGBUILD @ 2026-10-11 00:26
+++ PKGBUILD @ 2026-10-17 00:21
@@ -1,6 +1,6 @@
 pkgname=v2ray-rs-bin
 _pkgname=v2ray-rs
-pkgver=0.19.1
+pkgver=0.20.0
 pkgrel=1
 pkgdesc="Linux desktop GUI for v2ray/xray/sing-box proxy management (prebuilt)"
 arch=('x86_64')
@@ -17,7 +17,7 @@
 )
 install=v2ray-rs.install
 source=("$pkgname-$pkgver.tar.gz::$url/releases/download/v$pkgver/v2ray-rs-$CARCH-linux.tar.gz")
-sha256sums=('3919e714b298e77a924b55ae55b99b21c521ec7d984dae73cca4ecc3660eab66')
+sha256sums=('1b74bc36981aba52a17c8003f0dcfc4559f953125a6f9712a9541ae8e4d83266')
 
 package() {
     cd "$_pkgname-$pkgver-$CARCH-linux"

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2
2026-10-12 00:18:51	Low	2
2026-10-11 23:11:19	Medium	1
2026-10-11 00:26:05	Low	2
2026-10-10 00:11:52	Low	2
2026-10-09 00:05:33	Low	2
2026-10-08 00:28:03	Low	2
2026-10-07 00:21:34	Low	2
2026-10-06 00:13:36	Low	2
2026-10-05 00:08:03	Low	2
2026-10-04 00:18:08	Low	2
2026-10-03 00:23:04	Low	2
2026-10-02 00:00:32	Low	2
2026-10-01 00:02:06	Low	2
2026-09-30 00:20:07	Low	2
2026-09-29 00:07:46	Low	2