virtualbox-bin-guest-iso

LOW
maintainer dbermond 62 votes base virtualbox-bin scanned 2026-11-01 00:21:48.120785
View on AUR
Why flagged

The package downloads official Oracle VirtualBox binaries from virtualbox.org, a legitimate and expected source for this software, and applies standard packaging steps; the use of setuid binaries is a normal requirement for VirtualBox functionality and not inherently malicious.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads official Oracle VirtualBox binaries from virtualbox.org, a legitimate and expected source for this software, and applies standard packaging steps; the use of setuid binaries is a normal requirement for VirtualBox functionality and not inherently malicious.

2 higher static findings superseded - not the current verdict (shown for transparency)
Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:32 source=("http://download.virtualbox.org/virtualbox/${pkgver}/VirtualBox-${pkgver}-${_build}-Linux_amd64.run"
Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

  • PKGBUILD:128 chmod 4755 "${pkgdir}/${_installdir}"/{VirtualBoxVM,VBox{Headless,Net{AdpCtl,DHCP,NAT},VolInfo}}

PKGBUILD

2 offending line(s) highlighted
1# Maintainer : Daniel Bermond <dbermond@archlinux.org>
2# Contributor: Rainmaker <rainmaker52@gmail.com>
3# Contributor: gary9872 <garysBoXatgeemale.com>
4# Contributor: khomutsky <bogdan@khomutsky.com>
5# Contributor: M0Rf30
6
7pkgbase=virtualbox-bin
8pkgname=(
9 'virtualbox-bin'
10 'virtualbox-bin-guest-iso'
11 'virtualbox-bin-sdk')
12pkgver=7.2.22
13_build=175245
14_sdk_commit=72af1bf47ae4fa0cbca89251155953051c5acd67
15pkgrel=1
16pkgdesc='Powerful x86 virtualization for enterprise as well as home use (Oracle branded non-OSE)'
17arch=('x86_64')
18url='https://www.virtualbox.org/'
19license=('GPL-3.0-only')
20makedepends=(
21 'at-spi2-core' # to satisfy namcap
22 'cairo' # to satisfy namcap
23 'gdk-pixbuf2' # to satisfy namcap
24 #'gtk2' # to satisfy namcap
25 'gtk3' # to satisfy namcap
26 'pango' # to satisfy namcap
27 'python'
28 'python-build'
29 'python-installer'
30 'python-setuptools'
31 'python-wheel')
32source=("http://download.virtualbox.org/virtualbox/${pkgver}/VirtualBox-${pkgver}-${_build}-Linux_amd64.run"
33 "https://download.virtualbox.org/virtualbox/${pkgver}/VirtualBoxSDK-${pkgver}-${_build}.zip"
34 "VBoxAuth-g${_sdk_commit:0:7}.h"::"https://raw.githubusercontent.com/VirtualBox/virtualbox/${_sdk_commit}/include/VBox/VBoxAuth.h"
35 "VBoxAuthPAM-g${_sdk_commit:0:7}.c"::"https://raw.githubusercontent.com/VirtualBox/virtualbox/${_sdk_commit}/src/VBox/HostServices/auth/pam/VBoxAuthPAM.c"
36 "VBoxAuthSimple-g${_sdk_commit:0:7}.cpp"::"https://raw.githubusercontent.com/VirtualBox/virtualbox/${_sdk_commit}/src/VBox/HostServices/auth/simple/VBoxAuthSimple.cpp"
37 'dkms.conf'
38 'vboxreload'
39 '60-vboxdrv.rules'
40 'vboxweb.service'
41 'virtualbox.sysusers'
42 'LICENSE.sdk'
43 '013-Makefile.patch')
44noextract=("VirtualBoxSDK-${pkgver}-${_build}.zip")
45sha256sums=('cdaa722cbb751b812119b6b35f5601b3bb64afdc4726936ffe5824128a3ee7db'
46 '9fd2d4b60cd4b5ec4078962624336ae7e8f76c39d788025038be3c5e85e03152'
47 'f54c6a3e118e24ea36474b23e6376bf83ed945e76bb627257457c018f0e11018'
48 '0fe446cdc96d227e3f9a2d905d39ea2804c15560a42ff2dec207349f03ac9206'
49 'a2923c8828c540ae2e2b4da38c402892b8e16d19fb86af2ecb0ab080e3745c9e'
50 '63f1e9eabedec2170bd0589aaa2bf5025ff8f8ec1764cc4823cbe446e9ce1388'
51 '4001b5927348fe669a541e80526d4f9ea91b883805f102f7d571edbb482a9b9d'
52 '9c5238183019f9ebc7d92a8582cad232f471eab9d3278786225abc1a1c7bf66e'
53 'e6e875ef186578b53106d7f6af48e426cdaf1b4e86834f01696b8ef1c685787f'
54 '2101ebb58233bbfadf3aa74381f22f7e7e508559d2b46387114bc2d8e308554c'
55 '09335d7d1075df02d29cec13119538134efdf43ea73a93b0f89d0d7d4b6625a1'
56 'a3ec0cab869e2d64914bffbf1c11a3c571808438656af654932f96e7a69114fd')
57
58prepare() {
59 local _extractdir="${pkgbase}-${pkgver}/VirtualBox-extracted"
60
61 # extract files
62 mkdir -p "$_extractdir"
63 sh "VirtualBox-${pkgver}-${_build}-Linux_amd64.run" --noexec --nox11 --target "${pkgbase}-${pkgver}"
64 bsdtar -xf "${pkgbase}-${pkgver}/VirtualBox.tar.bz2" -C "$_extractdir"
65 bsdtar -xf "VirtualBoxSDK-${pkgver}-${_build}.zip" -C "${pkgbase}-${pkgver}"
66
67 # dkms configuration
68 install -D -m644 dkms.conf -t "${_extractdir}/src/vboxhost"
69 sed -i "s/^\(PACKAGE_VERSION\)=.*/\1=${pkgver}/" "${_extractdir}/src/vboxhost/dkms.conf"
70
71 # fix dkms build
72 patch -d "$_extractdir" -Np1 -i "${srcdir}/013-Makefile.patch"
73}
74
75build() {
76 cd "${pkgbase}-${pkgver}/sdk/installer/python/vboxapi"
77 VBOX_INSTALL_PATH='/opt/VirtualBox' python -m build --wheel --no-isolation
78}
79
80package_virtualbox-bin() {
81 depends=(
82 'bash'
83 'dbus'
84 'dkms'
85 'fontconfig'
86 'freetype2'
87 'glib2'
88 'glibc'
89 'hicolor-icon-theme'
90 'libgcc'
91 'libgl'
92 'libstdc++'
93 'libx11'
94 'libxcb'
95 'libxkbcommon'
96 'libxkbcommon-x11'
97 'libxt'
98 'wayland'
99 'xcb-util-cursor'
100 'xcb-util-image'
101 'xcb-util-keysyms'
102 'xcb-util-renderutil'
103 'xcb-util-wm'
104 'zlib')
105 optdepends=(
106 'at-spi2-core: for GTK2/GTK3 platformthemes plugins and GTK2 styles plugin'
107 'cairo: for GTK3 platformthemes plugin'
108 'gdk-pixbuf2: for GTK2/GTK3 platformthemes plugins and GTK2 styles plugin'
109 'gtk2: for GTK2 platformthemes and styles plugins'
110 'gtk3: for GTK3 platformthemes plugin'
111 'pango: for GTK2/GTK3 platformthemes plugins and GTK2 styles plugin'
112 'virtualbox-bin-guest-iso: for guest additions CD image'
113 'virtualbox-bin-sdk: for the software developer kit'
114 'virtualbox-ext-oracle: for Oracle extensions pack')
115 provides=("virtualbox=${pkgver}" 'virtualbox-host-dkms' 'VIRTUALBOX-HOST-MODULES')
116 conflicts=('virtualbox' 'virtualbox-host-dkms' 'virtualbox-host-modules-arch')
117 replaces=('virtualbox_bin' 'virtualbox-sun')
118 backup=('etc/vbox/vbox.cfg')
119 options=('!debug' '!emptydirs' '!strip')
120
121 local _installdir='opt/VirtualBox'
122
123 # install bundled files
124 install -d -m755 "${pkgdir}/opt"
125 cp -Pr --no-preserve='ownership' "${pkgbase}-${pkgver}/VirtualBox-extracted" "${pkgdir}/${_installdir}"
126
127 # mark binaries suid root, and make sure the directory is only writable by the user
128 chmod 4755 "${pkgdir}/${_installdir}"/{VirtualBoxVM,VBox{Headless,Net{AdpCtl,DHCP,NAT},VolInfo}}
129 chmod go-w "${pkgdir}/${_installdir}"
130
131 # remove guest iso and bundled sdk files
132 rm -r "${pkgdir}/${_installdir}"/{additions/VBoxGuestAdditions.iso,sdk}
133
134 # module sources_pypath
135 install -d -m755 "${pkgdir}/usr/src"
136 mv "${pkgdir}/${_installdir}/src/vboxhost" "${pkgdir}/usr/src/vboxhost-${pkgver}_non_OSE"
137
138 # module reloading shortcut (with a symlink with default helper)
139 install -D -m755 vboxreload -t "${pkgdir}/usr/bin"
140 ln -s vboxreload "${pkgdir}/usr/bin/rcvboxdrv"
141
142 # udev rules
143 ## we need to copy and not symlink VBoxCreateUSBNode.sh in /usr/lib/udev to avoid udevd
144 ## to look /opt when /opt is not mounted. This can be done until VBoxCreateUSBNode.sh doesn't
145 ## need more stuff from /opt
146 install -D -m644 60-vboxdrv.rules -t "${pkgdir}/usr/lib/udev/rules.d"
147 install -D -m755 "${pkgdir}/${_installdir}/VBoxCreateUSBNode.sh" -t "${pkgdir}/usr/lib/udev"
148 install -D -m755 "${pkgdir}/${_installdir}/VBoxCreateUSBNode.sh" -t "${pkgdir}/usr/share/virtualbox"
149
150 # configuration file
151 install -D -m644 <(printf '%s\n' "INSTALL_DIR=/${_installdir}") "${pkgdir}/etc/vbox/vbox.cfg"
152
153 # modules-load.d configuration
154 install -D -m644 <(printf 'vboxdrv\nvboxnetadp\nvboxnetflt\n') "${pkgdir}/usr/lib/modules-load.d/${pkgname}.conf"
155
156 # systemd
157 install -D -m644 vboxweb.service -t "${pkgdir}/usr/lib/systemd/system"
158 install -D -m644 virtualbox.sysusers "${pkgdir}/usr/lib/sysusers.d/virtualbox.conf"
159
160 # symlinks
161 local _dir
162 local _file
163 install -d -m755 "${pkgdir}/usr/share"/{applications,{doc,licenses}/"$pkgname",mime/packages,pixmaps}
164 for _file in vboxwebsrv VirtualBox{,VM} VBox{Manage,SDL,VRDP,Headless,Autostart,BalloonCtrl,BugReport,DTrace}
165 do
166 ln -s "../../${_installdir}/VBox.sh" "${pkgdir}/usr/bin/${_file}"
167 [ "$_file" != 'vboxwebsrv' ] && ln -s "../../${_installdir}/VBox.sh" "${pkgdir}/usr/bin/${_file,,}"
168 done
169 ln -s "../../../${_installdir}/VBoxSysInfo.sh" "${pkgdir}/usr/share/virtualbox/VBoxSysInfo.sh"
170 ln -s "../../../usr/src/vboxhost-${pkgver}_non_OSE" "${pkgdir}/${_installdir}/src/vboxhost"
171 ln -s "../../../${_installdir}/VBox.png" "${pkgdir}/usr/share/pixmaps/VBox.png"
172 ln -s "../../../${_installdir}/virtualbox.desktop" "${pkgdir}/usr/share/applications/virtualbox.desktop"
173 ln -s "../../../../${_installdir}/virtualbox.xml" "${pkgdir}/usr/share/mime/packages/virtualbox.xml"
174 ln -s "../../../../${_installdir}/UserManual.pdf" "${pkgdir}/usr/share/doc/${pkgname}/UserManual.pdf"
175 ln -s "../../../../${_installdir}/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
176 ## hicolor icons
177 while read -r -d '' _file
178 do
179 if grep -Eq '/virtualbox\.(png|svg)$' <<< "$_file"
180 then
181 _dir="${_file%/*}/apps"
182 else
183 _dir="${_file%/*}/mimetypes"
184 fi
185 install -d -m755 "${pkgdir}/usr/share/icons/hicolor/${_dir}"
186 ln -s "../../../../../../${_installdir}/icons/${_dir%/*}/${_file##*/}" \
187 "${pkgdir}/usr/share/icons/hicolor/${_dir}/${_file##*/}"
188 done < <(find "${pkgdir}/${_installdir}/icons" -type f -print0 | sed -z "s|${pkgdir}/${_installdir}/icons/||")
189 ## workaround for unsupported $ORIGIN/.. in VBoxC.so
190 for _file in VBox{RT,XPCOM}.so
191 do
192 ln -s "../${_file}" "${pkgdir}/${_installdir}/components/${_file}"
193 done
194
195 # https://www.virtualbox.org/ticket/22193
196 # https://bbs.archlinux.org/viewtopic.php?pid=2199183#p2199183
197 ln -s ../../usr/lib/libdl.so.2 "${pkgdir}/${_installdir}/libdl.so"
198 ln -s ../../usr/lib/libpthread.so.0 "${pkgdir}/${_installdir}/libpthread.so"
199 ln -sr /usr/lib/libdl.so.2 "${srcdir}/${pkgbase}-${pkgver}/VirtualBox-extracted/libdl.so"
200 ln -sr /usr/lib/libpthread.so.0 "${srcdir}/${pkgbase}-${pkgver}/VirtualBox-extracted/libpthread.so"
201}
202
203package_virtualbox-bin-guest-iso() {
204 pkgdesc='VirtualBox guest additions ISO image for use with virtualbox-bin package'
205 arch=('any')
206 provides=('virtualbox-guest-iso')
207
208 install -D -m644 "${pkgbase}-${pkgver}/VirtualBox-extracted/additions/VBoxGuestAdditions.iso" \
209 -t "${pkgdir}/opt/VirtualBox/additions"
210}
211
212package_virtualbox-bin-sdk() {
213 pkgdesc='VirtualBox software developer kit for use with virtualbox-bin package'
214 arch=('any')
215 license=('LGPL-2.1-only' 'GPL-3.0-only' 'LicenseRef-Custom')
216 depends=('python')
217 optdepends=('java-runtime: for webservice java bindings')
218 provides=('virtualbox-sdk')
219 conflicts=('virtualbox-sdk')
220
221 local _dir
222 local _installdir='opt/VirtualBox'
223
224 install -d -m755 "${pkgdir}/${_installdir}/sdk"
225 while read -r -d '' _dir
226 do
227 cp -Pr --no-preserve='ownership' "$_dir" "${pkgdir}/${_installdir}/sdk"
228 done < <(find "${pkgbase}-${pkgver}/sdk" -mindepth 1 -maxdepth 1 -type d ! -name 'installer' -print0)
229
230 install -D -m644 "VBoxAuth-g${_sdk_commit:0:7}.h" "${pkgdir}/${_installdir}/sdk/bindings/auth/include/VBoxAuth.h"
231 install -D -m644 "VBoxAuthPAM-g${_sdk_commit:0:7}.c" "${pkgdir}/${_installdir}/sdk/bindings/auth/VBoxAuthPAM.cpp"
232 install -D -m644 "VBoxAuthSimple-g${_sdk_commit:0:7}.cpp" "${pkgdir}/${_installdir}/sdk/bindings/auth/VBoxAuthSimple.cpp"
233 install -D -m644 LICENSE.sdk "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
234
235 python -m installer --destdir="$pkgdir" "${pkgbase}-${pkgver}/sdk/installer/python/vboxapi/dist"/*.whl
236
237 local _sitepkgs
238 _sitepkgs="$(python -c 'import site; print(site.getsitepackages()[0])')"
239 ln -s "../../../../${_installdir}/sdk/bindings/xpcom/python/xpcom" "${pkgdir}${_sitepkgs}/xpcom"
240}
241

Changes since previous scan

--- PKGBUILD @ 2026-10-25 00:20
+++ PKGBUILD @ 2026-11-01 00:21
@@ -9,8 +9,8 @@
'virtualbox-bin'
'virtualbox-bin-guest-iso'
'virtualbox-bin-sdk')
-pkgver=7.2.20
-_build=175154
+pkgver=7.2.22
+_build=175245
_sdk_commit=72af1bf47ae4fa0cbca89251155953051c5acd67
pkgrel=1
pkgdesc='Powerful x86 virtualization for enterprise as well as home use (Oracle branded non-OSE)'
@@ -42,8 +42,8 @@
'LICENSE.sdk'
'013-Makefile.patch')
noextract=("VirtualBoxSDK-${pkgver}-${_build}.zip")
-sha256sums=('14676e58ae57c543b9f3883fed8d266d9ec595083202c2a3acfc3cf350a21086'
- 'd94e4dddd5b99c84b2e328e8a19faff906168ad1d51e9545376f638108c0edc8'
+sha256sums=('cdaa722cbb751b812119b6b35f5601b3bb64afdc4726936ffe5824128a3ee7db'
+ '9fd2d4b60cd4b5ec4078962624336ae7e8f76c39d788025038be3c5e85e03152'
'f54c6a3e118e24ea36474b23e6376bf83ed945e76bb627257457c018f0e11018'
'0fe446cdc96d227e3f9a2d905d39ea2804c15560a42ff2dec207349f03ac9206'
'a2923c8828c540ae2e2b4da38c402892b8e16d19fb86af2ecb0ab080e3745c9e'

Scan history

Scanned at (UTC)SeverityRules
2026-11-01 00:21:48 Low 3
2026-10-31 00:07:41 Low 3
2026-10-30 00:29:30 Low 3
2026-10-29 00:13:55 Low 3
2026-10-28 00:06:54 Low 3
2026-10-27 00:23:28 Low 3
2026-10-26 00:12:40 Low 3
2026-10-25 17:43:03 Medium 2
2026-10-25 00:20:48 Low 3
2026-10-24 00:14:55 Low 3
2026-10-23 00:02:19 Low 3
2026-10-22 00:13:10 Low 3
2026-10-21 00:12:50 Low 3
2026-10-20 00:10:31 Low 3
2026-10-19 00:03:55 Low 3
2026-10-18 00:06:55 Low 3
2026-10-17 00:21:55 Low 3
2026-10-16 00:12:47 Low 3
2026-10-15 00:28:05 Low 3
2026-10-14 00:06:47 Low 3

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion