virtualbox-bin-sdk
maintainer dbermond
· 62 votes
· base
virtualbox-bin
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The package installs Oracle's official VirtualBox binary from a non-whitelisted but legitimate host, and sets suid permissions on legitimate virtualization binaries, which is normal for VirtualBox; no malicious or unverifiable code execution is present.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package installs Oracle's official VirtualBox binary from a non-whitelisted but legitimate host, and sets suid permissions on legitimate virtualization binaries, which is normal for VirtualBox; no malicious or unverifiable code execution is present.
2 higher static findings superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:32
source=("http://download.virtualbox.org/virtualbox/${pkgver}/VirtualBox-${pkgver}-${_build}-Linux_amd64.run"
MEDIUM
Privileged / out-of-pacman install (sudoers, setuid, or self-update)
privileged_install
The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.
-
PKGBUILD:130
chmod 4755 "${pkgdir}/${_installdir}"/{VirtualBoxVM,VBox{Headless,Net{AdpCtl,DHCP,NAT},VolInfo}}
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer : Daniel Bermond <dbermond@archlinux.org>
2
# Contributor: Rainmaker <rainmaker52@gmail.com>
3
# Contributor: gary9872 <garysBoXatgeemale.com>
4
# Contributor: khomutsky <bogdan@khomutsky.com>
5
# Contributor: M0Rf30
6
7
pkgbase=virtualbox-bin
8
pkgname=(
9
'virtualbox-bin'
10
'virtualbox-bin-guest-iso'
11
'virtualbox-bin-sdk')
12
pkgver=7.2.10
13
_build=174163
14
_sdk_commit=72af1bf47ae4fa0cbca89251155953051c5acd67
15
pkgrel=1
16
pkgdesc='Powerful x86 virtualization for enterprise as well as home use (Oracle branded non-OSE)'
17
arch=('x86_64')
18
url='https://www.virtualbox.org/'
19
license=('GPL-3.0-only')
20
makedepends=(
21
'at-spi2-core' # to satisfy namcap
22
'cairo' # to satisfy namcap
23
'gdk-pixbuf2' # to satisfy namcap
24
#'gtk2' # to satisfy namcap
25
'gtk3' # to satisfy namcap
26
'pango' # to satisfy namcap
27
'python'
28
'python-build'
29
'python-installer'
30
'python-setuptools'
31
'python-wheel')
32
source=("http://download.virtualbox.org/virtualbox/${pkgver}/VirtualBox-${pkgver}-${_build}-Linux_amd64.run"
33
"https://download.virtualbox.org/virtualbox/${pkgver}/VirtualBoxSDK-${pkgver}-${_build}.zip"
34
"VBoxAuth-g${_sdk_commit:0:7}.h"::"https://raw.githubusercontent.com/VirtualBox/virtualbox/${_sdk_commit}/include/VBox/VBoxAuth.h"
35
"VBoxAuthPAM-g${_sdk_commit:0:7}.c"::"https://raw.githubusercontent.com/VirtualBox/virtualbox/${_sdk_commit}/src/VBox/HostServices/auth/pam/VBoxAuthPAM.c"
36
"VBoxAuthSimple-g${_sdk_commit:0:7}.cpp"::"https://raw.githubusercontent.com/VirtualBox/virtualbox/${_sdk_commit}/src/VBox/HostServices/auth/simple/VBoxAuthSimple.cpp"
37
'dkms.conf'
38
'vboxreload'
39
'60-vboxdrv.rules'
40
'vboxweb.service'
41
'virtualbox.modprobe'
42
'virtualbox.sysusers'
43
'LICENSE.sdk'
44
'013-Makefile.patch')
45
noextract=("VirtualBoxSDK-${pkgver}-${_build}.zip")
46
sha256sums=('dffac09eeca64591aa6ed83ca4e0acc7b76cb0c1e3b48628f170e33d95ce0282'
47
'd192c65ca865ce483d29da83eacd5f9acc655e2834963fc0898720d8b8ae5df1'
48
'f54c6a3e118e24ea36474b23e6376bf83ed945e76bb627257457c018f0e11018'
49
'0fe446cdc96d227e3f9a2d905d39ea2804c15560a42ff2dec207349f03ac9206'
50
'a2923c8828c540ae2e2b4da38c402892b8e16d19fb86af2ecb0ab080e3745c9e'
51
'63f1e9eabedec2170bd0589aaa2bf5025ff8f8ec1764cc4823cbe446e9ce1388'
52
'4001b5927348fe669a541e80526d4f9ea91b883805f102f7d571edbb482a9b9d'
53
'9c5238183019f9ebc7d92a8582cad232f471eab9d3278786225abc1a1c7bf66e'
54
'e6e875ef186578b53106d7f6af48e426cdaf1b4e86834f01696b8ef1c685787f'
55
'07fe5c8b313cd7f01505eb9721357269a288ccd0c04e6467afb954038d6f46df'
56
'2101ebb58233bbfadf3aa74381f22f7e7e508559d2b46387114bc2d8e308554c'
57
'09335d7d1075df02d29cec13119538134efdf43ea73a93b0f89d0d7d4b6625a1'
58
'a3ec0cab869e2d64914bffbf1c11a3c571808438656af654932f96e7a69114fd')
59
60
prepare() {
61
local _extractdir="${pkgbase}-${pkgver}/VirtualBox-extracted"
62
63
# extract files
64
mkdir -p "$_extractdir"
65
sh "VirtualBox-${pkgver}-${_build}-Linux_amd64.run" --noexec --nox11 --target "${pkgbase}-${pkgver}"
66
bsdtar -xf "${pkgbase}-${pkgver}/VirtualBox.tar.bz2" -C "$_extractdir"
67
bsdtar -xf "VirtualBoxSDK-${pkgver}-${_build}.zip" -C "${pkgbase}-${pkgver}"
68
69
# dkms configuration
70
install -D -m644 dkms.conf -t "${_extractdir}/src/vboxhost"
71
sed -i "s/^\(PACKAGE_VERSION\)=.*/\1=${pkgver}/" "${_extractdir}/src/vboxhost/dkms.conf"
72
73
# fix dkms build
74
patch -d "$_extractdir" -Np1 -i "${srcdir}/013-Makefile.patch"
75
}
76
77
build() {
78
cd "${pkgbase}-${pkgver}/sdk/installer/python/vboxapi"
79
VBOX_INSTALL_PATH='/opt/VirtualBox' python -m build --wheel --no-isolation
80
}
81
82
package_virtualbox-bin() {
83
depends=(
84
'bash'
85
'dbus'
86
'dkms'
87
'fontconfig'
88
'freetype2'
89
'glib2'
90
'glibc'
91
'hicolor-icon-theme'
92
'libgcc'
93
'libgl'
94
'libstdc++'
95
'libx11'
96
'libxcb'
97
'libxkbcommon'
98
'libxkbcommon-x11'
99
'libxt'
100
'wayland'
101
'xcb-util-cursor'
102
'xcb-util-image'
103
'xcb-util-keysyms'
104
'xcb-util-renderutil'
105
'xcb-util-wm'
106
'zlib')
107
optdepends=(
108
'at-spi2-core: for GTK2/GTK3 platformthemes plugins and GTK2 styles plugin'
109
'cairo: for GTK3 platformthemes plugin'
110
'gdk-pixbuf2: for GTK2/GTK3 platformthemes plugins and GTK2 styles plugin'
111
'gtk2: for GTK2 platformthemes and styles plugins'
112
'gtk3: for GTK3 platformthemes plugin'
113
'pango: for GTK2/GTK3 platformthemes plugins and GTK2 styles plugin'
114
'virtualbox-bin-guest-iso: for guest additions CD image'
115
'virtualbox-bin-sdk: for the software developer kit'
116
'virtualbox-ext-oracle: for Oracle extensions pack')
117
provides=("virtualbox=${pkgver}" 'virtualbox-host-dkms' 'VIRTUALBOX-HOST-MODULES')
118
conflicts=('virtualbox' 'virtualbox-host-dkms' 'virtualbox-host-modules-arch')
119
replaces=('virtualbox_bin' 'virtualbox-sun')
120
backup=('etc/vbox/vbox.cfg')
121
options=('!debug' '!emptydirs' '!strip')
122
123
local _installdir='opt/VirtualBox'
124
125
# install bundled files
126
install -d -m755 "${pkgdir}/opt"
127
cp -Pr --no-preserve='ownership' "${pkgbase}-${pkgver}/VirtualBox-extracted" "${pkgdir}/${_installdir}"
128
129
# mark binaries suid root, and make sure the directory is only writable by the user
130
chmod 4755 "${pkgdir}/${_installdir}"/{VirtualBoxVM,VBox{Headless,Net{AdpCtl,DHCP,NAT},VolInfo}}
131
chmod go-w "${pkgdir}/${_installdir}"
132
133
# remove guest iso and bundled sdk files
134
rm -r "${pkgdir}/${_installdir}"/{additions/VBoxGuestAdditions.iso,sdk}
135
136
# module sources_pypath
137
install -d -m755 "${pkgdir}/usr/src"
138
mv "${pkgdir}/${_installdir}/src/vboxhost" "${pkgdir}/usr/src/vboxhost-${pkgver}_non_OSE"
139
140
# module reloading shortcut (with a symlink with default helper)
141
install -D -m755 vboxreload -t "${pkgdir}/usr/bin"
142
ln -s vboxreload "${pkgdir}/usr/bin/rcvboxdrv"
143
144
# do not enable KVM virtualization on module load
145
install -D -m0644 virtualbox.modprobe "${pkgdir}/usr/lib/modprobe.d/virtualbox.conf"
146
147
# udev rules
148
## we need to copy and not symlink VBoxCreateUSBNode.sh in /usr/lib/udev to avoid udevd
149
## to look /opt when /opt is not mounted. This can be done until VBoxCreateUSBNode.sh doesn't
150
## need more stuff from /opt
151
install -D -m644 60-vboxdrv.rules -t "${pkgdir}/usr/lib/udev/rules.d"
152
install -D -m755 "${pkgdir}/${_installdir}/VBoxCreateUSBNode.sh" -t "${pkgdir}/usr/lib/udev"
153
install -D -m755 "${pkgdir}/${_installdir}/VBoxCreateUSBNode.sh" -t "${pkgdir}/usr/share/virtualbox"
154
155
# configuration file
156
install -D -m644 <(printf '%s\n' "INSTALL_DIR=/${_installdir}") "${pkgdir}/etc/vbox/vbox.cfg"
157
158
# modules-load.d configuration
159
install -D -m644 <(printf 'vboxdrv\nvboxnetadp\nvboxnetflt\n') "${pkgdir}/usr/lib/modules-load.d/${pkgname}.conf"
160
161
# systemd
162
install -D -m644 vboxweb.service -t "${pkgdir}/usr/lib/systemd/system"
163
install -D -m644 virtualbox.sysusers "${pkgdir}/usr/lib/sysusers.d/virtualbox.conf"
164
165
# symlinks
166
local _dir
167
local _file
168
install -d -m755 "${pkgdir}/usr/share"/{applications,{doc,licenses}/"$pkgname",mime/packages,pixmaps}
169
for _file in vboxwebsrv VirtualBox{,VM} VBox{Manage,SDL,VRDP,Headless,Autostart,BalloonCtrl,BugReport,DTrace}
170
do
171
ln -s "../../${_installdir}/VBox.sh" "${pkgdir}/usr/bin/${_file}"
172
[ "$_file" != 'vboxwebsrv' ] && ln -s "../../${_installdir}/VBox.sh" "${pkgdir}/usr/bin/${_file,,}"
173
done
174
ln -s "../../../${_installdir}/VBoxSysInfo.sh" "${pkgdir}/usr/share/virtualbox/VBoxSysInfo.sh"
175
ln -s "../../../usr/src/vboxhost-${pkgver}_non_OSE" "${pkgdir}/${_installdir}/src/vboxhost"
176
ln -s "../../../${_installdir}/VBox.png" "${pkgdir}/usr/share/pixmaps/VBox.png"
177
ln -s "../../../${_installdir}/virtualbox.desktop" "${pkgdir}/usr/share/applications/virtualbox.desktop"
178
ln -s "../../../../${_installdir}/virtualbox.xml" "${pkgdir}/usr/share/mime/packages/virtualbox.xml"
179
ln -s "../../../../${_installdir}/UserManual.pdf" "${pkgdir}/usr/share/doc/${pkgname}/UserManual.pdf"
180
ln -s "../../../../${_installdir}/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
181
## hicolor icons
182
while read -r -d '' _file
183
do
184
if grep -Eq '/virtualbox\.(png|svg)$' <<< "$_file"
185
then
186
_dir="${_file%/*}/apps"
187
else
188
_dir="${_file%/*}/mimetypes"
189
fi
190
install -d -m755 "${pkgdir}/usr/share/icons/hicolor/${_dir}"
191
ln -s "../../../../../../${_installdir}/icons/${_dir%/*}/${_file##*/}" \
192
"${pkgdir}/usr/share/icons/hicolor/${_dir}/${_file##*/}"
193
done < <(find "${pkgdir}/${_installdir}/icons" -type f -print0 | sed -z "s|${pkgdir}/${_installdir}/icons/||")
194
## workaround for unsupported $ORIGIN/.. in VBoxC.so
195
for _file in VBox{RT,XPCOM}.so
196
do
197
ln -s "../${_file}" "${pkgdir}/${_installdir}/components/${_file}"
198
done
199
200
# https://www.virtualbox.org/ticket/22193
201
# https://bbs.archlinux.org/viewtopic.php?pid=2199183#p2199183
202
ln -s ../../usr/lib/libdl.so.2 "${pkgdir}/${_installdir}/libdl.so"
203
ln -s ../../usr/lib/libpthread.so.0 "${pkgdir}/${_installdir}/libpthread.so"
204
ln -sr /usr/lib/libdl.so.2 "${srcdir}/${pkgbase}-${pkgver}/VirtualBox-extracted/libdl.so"
205
ln -sr /usr/lib/libpthread.so.0 "${srcdir}/${pkgbase}-${pkgver}/VirtualBox-extracted/libpthread.so"
206
}
207
208
package_virtualbox-bin-guest-iso() {
209
pkgdesc='VirtualBox guest additions ISO image for use with virtualbox-bin package'
210
arch=('any')
211
provides=('virtualbox-guest-iso')
212
213
install -D -m644 "${pkgbase}-${pkgver}/VirtualBox-extracted/additions/VBoxGuestAdditions.iso" \
214
-t "${pkgdir}/opt/VirtualBox/additions"
215
}
216
217
package_virtualbox-bin-sdk() {
218
pkgdesc='VirtualBox software developer kit for use with virtualbox-bin package'
219
arch=('any')
220
license=('LGPL-2.1-only' 'GPL-3.0-only' 'LicenseRef-Custom')
221
depends=('python')
222
optdepends=('java-runtime: for webservice java bindings')
223
provides=('virtualbox-sdk')
224
conflicts=('virtualbox-sdk')
225
226
local _dir
227
local _installdir='opt/VirtualBox'
228
229
install -d -m755 "${pkgdir}/${_installdir}/sdk"
230
while read -r -d '' _dir
231
do
232
cp -Pr --no-preserve='ownership' "$_dir" "${pkgdir}/${_installdir}/sdk"
233
done < <(find "${pkgbase}-${pkgver}/sdk" -mindepth 1 -maxdepth 1 -type d ! -name 'installer' -print0)
234
235
install -D -m644 "VBoxAuth-g${_sdk_commit:0:7}.h" "${pkgdir}/${_installdir}/sdk/bindings/auth/include/VBoxAuth.h"
236
install -D -m644 "VBoxAuthPAM-g${_sdk_commit:0:7}.c" "${pkgdir}/${_installdir}/sdk/bindings/auth/VBoxAuthPAM.cpp"
237
install -D -m644 "VBoxAuthSimple-g${_sdk_commit:0:7}.cpp" "${pkgdir}/${_installdir}/sdk/bindings/auth/VBoxAuthSimple.cpp"
238
install -D -m644 LICENSE.sdk "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
239
240
python -m installer --destdir="$pkgdir" "${pkgbase}-${pkgver}/sdk/installer/python/vboxapi/dist"/*.whl
241
242
local _sitepkgs
243
_sitepkgs="$(python -c 'import site; print(site.getsitepackages()[0])')"
244
ln -s "../../../../${_installdir}/sdk/bindings/xpcom/python/xpcom" "${pkgdir}${_sitepkgs}/xpcom"
245
}
246
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 3 |
| 2026-08-02 00:16:08 | LOW | 3 |
| 2026-08-01 00:11:18 | LOW | 3 |
| 2026-07-31 00:14:10 | LOW | 3 |
| 2026-07-30 00:17:23 | LOW | 3 |
| 2026-07-29 00:25:53 | LOW | 3 |
| 2026-07-28 00:07:28 | LOW | 3 |
| 2026-07-27 00:24:32 | LOW | 3 |
| 2026-07-26 00:07:32 | LOW | 3 |
| 2026-07-25 00:13:44 | LOW | 3 |
| 2026-07-24 00:02:28 | LOW | 3 |
| 2026-07-23 00:14:47 | LOW | 3 |
| 2026-07-22 00:29:32 | LOW | 3 |
| 2026-07-21 00:24:15 | LOW | 3 |
| 2026-07-20 00:19:49 | LOW | 3 |
| 2026-07-19 00:17:08 | LOW | 3 |
| 2026-07-18 00:14:48 | LOW | 3 |
| 2026-07-17 00:06:16 | LOW | 3 |
| 2026-07-16 00:05:41 | LOW | 3 |
| 2026-07-15 00:09:25 | LOW | 3 |