zfs-linux-git-headers

maintainer severach · 26 votes · base zfs-linux-git · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The use of eval is limited to safely expanding dependency arrays with kernel version constraints, and the privileged install refers to standard DKMS module registration, not malicious activity.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The use of eval is limited to safely expanding dependency arrays with kernel version constraints, and the privileged install refers to standard DKMS module registration, not malicious activity.

PKGBUILD:283 _z="$(declare -f package_zfs-linux-git)"; eval "${_z//-git/}"
PKGBUILD:337 _z="$(declare -f package_zfs-utils-git)"; eval "${_z//-git/}"
PKGBUILD:379 _z="$(declare -f package_zfs-linux-git-headers)"; eval "${_z//-git/}"

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

PKGBUILD:349 rm -fr "${pkgdir}"/etc/sudoers.d

PKGBUILD

4 offending line(s) highlighted

      1# Maintainer:  Chris Severance aur.severach aATt spamgourmet dott com
    
      2# Contributor: Kevin Stolp <kevinstolp@gmail.com>
    
      3# Contributor: Eli Schwartz <eschwartz@archlinux.org>
    
      4# Contributor: Iacopo Isimbaldi <isiachi@rhye.it>
    
      5# Contributor: Jan Houben <jan@nexttrex.de>
    
      6# Contributor: Jesus Alvarez <jeezusjr at gmail dot com>
    
      7
    
      8# todo: why is -git in the middle of linux-git-headers?
    
      9
    
      10_opt_DKMS=0
    
      11
    
      12_opt_UTIL=2 # default 2
    
      13# 0 - zfs-utils is a separate package
    
      14# 1 - zfs-utils is a package split here
    
      15# 2 - zfs-utils is integrated into zfs-linux
    
      16
    
      17_opt_git=''
    
      18_opt_git='-git'
    
      19
    
      20# Additional option: see _commit below
    
      21# Commit branches with newer version numbers have both newer and older code than master.
    
      22
    
      23set -u
    
      24pkgbase="zfs-linux${_opt_git}"
    
      25pkgname=("${pkgbase}")
    
      26if [ "${_opt_DKMS}" -eq 0 ]; then
    
      27  pkgname+=("${pkgbase}-headers")
    
      28fi
    
      29if [ "${_opt_UTIL}" -eq 1 ]; then
    
      30  pkgname+=("zfs-utils${_opt_git}")
    
      31fi
    
      32pkgver=2.4.99.r705.gc0f62d4fdf
    
      33pkgrel=1
    
      34_pkgver="${pkgver%%.r*}"
    
      35#_commit="#branch=zfs-${_pkgver%.*}-release"
    
      36arch=('x86_64' 'aarch64')
    
      37url='https://zfsonlinux.org/'
    
      38license=('CDDL-1.0')
    
      39depends=('kmod' 'linux')
    
      40if [ "${_opt_UTIL}" -ge 1 ]; then
    
      41  depends+=('glibc' 'gcc-libs' 'python' 'bash' 'zlib' 'openssl' 'util-linux-libs' 'pam' 'systemd-libs' 'libtirpc')
    
      42fi
    
      43makedepends=('perl' 'python')
    
      44if [ ! -z "${_opt_git}" ]; then
    
      45  makedepends+=('git' 'linux-headers')
    
      46  _srcdir='zfs'
    
      47else
    
      48  _srcdir="zfs-${_pkgver}"
    
      49fi
    
      50#options=('!strip')
    
      51source=(
    
      52  "https://github.com/zfsonlinux/zfs/releases/download/zfs-${_pkgver}/zfs-${_pkgver}.tar.gz"
    
      53  '0001-only-build-the-module-in-dkms.conf.patch'
    
      54)
    
      55if [ "$(vercmp "${_pkgver}" '0.8.3')" -eq 0 ]; then
    
      56  source+=('linux-5.5-compat-blkg_tryget.patch')
    
      57fi
    
      58source+=(
    
      59  'zfs-node-permission.conf'
    
      60  'zfs.initcpio.install'
    
      61  'zfs.initcpio.hook'
    
      62  'zfs.initcpio.zfsencryptssh.install'
    
      63)
    
      64md5sums=('SKIP'
    
      65         'f607f969110a7b36a7a45b28b1f4343d'
    
      66         '64ea2befebf1e9fa1556e464e80eb528'
    
      67         'eca615c602740315333aedd417d83541'
    
      68         'fa15be4761c8a56ad0177d1a06a4c7f8'
    
      69         '2c11143d6d54c817f77efd1fdfea1b5c')
    
      70sha256sums=('SKIP'
    
      71            '0b28be1e55248435739c9d68fd85acd969b150a5b6216fd63d05cf892e352dac'
    
      72            '7ad45fd291aa582639725f14d88d7da5bd3d427012b25bddbe917ca6d1a07c1a'
    
      73            'da1cdc045d144d2109ec7b5d97c53a69823759d8ecff410e47c3a66b69e6518d'
    
      74            '9c20256093997f7cfa9e7eb5d85d4a712d528a6ff19ef35b83ad03fb1ceae3bc'
    
      75            'ac9ed396465e26fa6896762c52a93eb7aaf8af6d7b2c69bd826d219ff821b2c9')
    
      76
    
      77_extramodules="$(uname -r)"
    
      78
    
      79# Find valid installed kernel to build for next boot after upgrading kernel
    
      80_fn_calc_extramodules() {
    
      81  local _ev="${_extramodules%%-*}"
    
      82  local _fmax=''
    
      83  local _f _fv
    
      84  for _f in /usr/lib/modules/${_ev%.*}.*/build/Makefile; do
    
      85    _f="${_f#/usr/lib/modules/}"
    
      86    _f="${_f%/build/Makefile}"
    
      87    _fv="${_f%%-*}"
    
      88    if [ -z "${_fmax}" ] || [ "$(pkgver "${_ev}" "${_fmax}")" -ge 0 ]; then
    
      89      _fmax="${_f}"
    
      90    fi
    
      91  done
    
      92  if [ ! -z "${_fmax}" ] && [ "${_extramodules}" != "${_fmax}" ]; then
    
      93    echo "Found upgraded kernel ${_fmax}"
    
      94    _extramodules="${_fmax}"
    
      95  fi
    
      96}
    
      97
    
      98if [ ! -z "${_opt_git}" ]; then
    
      99  source[0]="git+https://github.com/zfsonlinux/zfs.git${_commit:-}"
    
      100  md5sums[0]='SKIP'
    
      101  sha256sums[0]='SKIP'
    
      102pkgver() {
    
      103  local -; set -u
    
      104  cd "${_srcdir}"
    
      105  git describe --long | sed -e 's/^zfs-//' -e 's/\([^-]*-g\)/r\1/' -e 's/-/./g'
    
      106}
    
      107elif [ "${_pkgver}" != "${pkgver}" ]; then
    
      108pkgver() {
    
      109  local -; set -u
    
      110  echo "${_pkgver}"
    
      111}
    
      112fi
    
      113
    
      114if [ ! -z "${HOME:-}" ]; then # block mksrcinfo
    
      115  _fn_calc_extramodules
    
      116  _fn_calc_extramodules() { true; }
    
      117  if [ "${_opt_DKMS}" -eq 0 ]; then
    
      118    pkgver+=".k${_extramodules%%-*}"
    
      119  fi
    
      120fi
    
      121
    
      122prepare() {
    
      123  local -; set -u
    
      124  cd "${_srcdir}"
    
      125
    
      126  #From: Eli Schwartz <eschwartz@archlinux.org>
    
      127  #Date: Sun, 28 Oct 2018 15:01:58 -0400
    
      128  #Subject: [PATCH] only build the module in dkms.conf
    
      129  #cd '..'; cp -pr "${_srcdir}" 'a'; ln -s "${_srcdir}" 'b'; false
    
      130  # diff -pNaru4 'a' 'b' > '0001-only-build-the-module-in-dkms.conf.patch'
    
      131  patch -Nup1 -i "${srcdir}/0001-only-build-the-module-in-dkms.conf.patch"
    
      132
    
      133  # DKMS install customized all the way back to autoconf
    
      134  local _dkmsdir="${srcdir}/dkms.Arch"
    
      135  # makepkg -i on git packages reruns prepare()
    
      136  if [ ! -z "${_opt_git}" ]; then
    
      137    rm -rf "${_dkmsdir}"
    
      138  fi
    
      139  if [ "${_opt_DKMS}" -ne 0 ] && [ ! -d "${_dkmsdir}" ]; then
    
      140    install -d "${_dkmsdir}"
    
      141    cp -rp . "${_dkmsdir}"
    
      142    pushd "${_dkmsdir}" > /dev/null
    
      143    rm -f 'configure'
    
      144    # remove unneeded sections from module build
    
      145    sed -re "/AC_CONFIG_FILES/,/]\)/{
    
      146/AC_CONFIG_FILES/n
    
      147/]\)/n
    
      148/^\s*(module\/.*)?(${pkgname%-dkms}.release|Makefile)/!d
    
      149}" -i 'configure.ac'
    
      150    popd > /dev/null
    
      151  fi
    
      152}
    
      153
    
      154build() {
    
      155  local -; set -u
    
      156  cd "${_srcdir}"
    
      157  if [ ! -s 'configure' ]; then
    
      158    ./autogen.sh
    
      159  fi
    
      160  if [ "${_opt_DKMS}" -ne 0 ]; then
    
      161    local _dkmsdir="${srcdir}/dkms.Arch"
    
      162    pushd "${_dkmsdir}" > /dev/null
    
      163    if [ ! -s 'configure' ]; then
    
      164      ./autogen.sh
    
      165      ./scripts/dkms.mkconf -n 'zfs' -v "${_pkgver}" -f 'dkms.conf'
    
      166      if [ ! -z "${_opt_git}" ]; then
    
      167        # update metadata
    
      168        ./scripts/make_gitrev.sh
    
      169        local _meta_release="${pkgver#*.r}"
    
      170        sed -e "s/Release:[[:print:]]*/Release:      ${_meta_release/./_}/" -i 'META'
    
      171      fi
    
      172    fi
    
      173    popd > /dev/null
    
      174  fi
    
      175  if [ ! -s 'Makefile' ]; then
    
      176    _fn_calc_extramodules
    
      177    local _cf=(
    
      178      --prefix='/usr'
    
      179      --sysconfdir='/etc'
    
      180      --sbindir='/usr/bin'
    
      181      #--libdir='/usr/lib'
    
      182      #--datadir='/usr/share'
    
      183      #--includedir='/usr/include'
    
      184      #--with-mounthelperdir='/usr/bin'
    
      185      --with-udevdir='/usr/lib/udev'
    
      186      --libexecdir='/usr/lib'
    
      187      --localstatedir='/var'
    
      188      --without-libunwind
    
      189      #--with-python="$PWD/python3-fake"
    
      190      #--enable-pyzfs='no'
    
      191      --enable-systemd
    
      192      #--with-config='user'
    
      193      # kernel module build
    
      194      --with-config='kernel'
    
      195      --with-linux="/usr/lib/modules/${_extramodules}/build"
    
      196      --with-linux-obj="/usr/lib/modules/${_extramodules}/build"
    
      197    )
    
      198    if [ "${_opt_UTIL}" -ge 1 ]; then
    
      199      _cf+=(
    
      200      # utils build
    
      201      --with-config='user'
    
      202      --enable-pyzfs='no'
    
      203      --with-mounthelperdir='/usr/bin'
    
      204      # all build
    
      205      --with-config='all'
    
      206      )
    
      207      if [ "$(vercmp "${pkgver}" '0.8.0')" -le 0 ] && [ -z "${_opt_git}" ]; then
    
      208        # pyzfs is not built, but build system tries to check for python anyway
    
      209        # fixed in master
    
      210        ln -s '/bin/true' 'python3-fake'
    
      211        _cf+=(
    
      212          --with-python="${PWD}/python3-fake"
    
      213        )
    
      214      fi
    
      215    fi
    
      216    # Disable tree vectorization. Related issues:
    
      217    # https://github.com/openzfs/zfs/issues/13605
    
      218    # https://github.com/openzfs/zfs/issues/13620
    
      219    CFLAGS="${CFLAGS} -fno-tree-vectorize" \
    
      220    CXXFLAGS="${CXXFLAGS} -fno-tree-vectorize" \
    
      221    nice -n1 \
    
      222    ./configure "${_cf[@]}"
    
      223  fi
    
      224  nice -n1 make -s
    
      225
    
      226  # make install is very slow. Much faster to do this once and copy
    
      227  rm -rf "${srcdir}/inst"
    
      228  install -d "${srcdir}/inst"
    
      229  make -s -j1 DESTDIR="${srcdir}/inst" install
    
      230}
    
      231
    
      232package_zfs-linux-git() {
    
      233  local -; set -u
    
      234  pkgdesc='Kernel modules for the Zettabyte File System.'
    
      235  install='zfs.install'
    
      236  provides=("zfs=${_pkgver}" "zfs-linux=${_pkgver}" "spl=${_pkgver}")
    
      237  #groups=('archzfs-linux-git')
    
      238  conflicts=('zfs-dkms' 'zfs-dkms-git' 'zfs-dkms-rc' 'spl-dkms' 'spl-dkms-git' 'zfs-linux' 'spl-linux-git' 'spl-linux')
    
      239  replaces=('spl-linux-git')
    
      240  #if [ "${_opt_UTIL}" -le 1 ]; then
    
      241    depends+=("zfs-utils>=${_pkgver}")
    
      242  #fi
    
      243
    
      244  cd "${_srcdir}"
    
      245  cp -rp "${srcdir}/inst"/* "${pkgdir}"
    
      246
    
      247  _fix_modules
    
      248  if [ "${_opt_UTIL}" -eq 2 ]; then
    
      249    provides+=("zfs-utils=${_pkgver}")
    
      250    conflicts+=('zfs-linux' 'zfs-utils')
    
      251    _fix_utils
    
      252  else
    
      253    _del_utils
    
      254  fi
    
      255  _del_headers
    
      256
    
      257  if [ "${_opt_DKMS}" -eq 0 ]; then
    
      258    # linux not maintained by severach are broken without provides
    
      259    if [ "$(vercmp "${_extramodules%%-*}" '4.19')" -lt 0 ]; then
    
      260      # I don't want Linux version info showing on AUR web. After a few months 'linux<0.0.0' makes it look like an out of date package.
    
      261      _fn_calc_extramodules
    
      262      local _kernelversionsmall="${_extramodules}"
    
      263      _kernelversionsmall="${_kernelversionsmall%%-*}"
    
      264      _kernelversionsmall="${_kernelversionsmall%.0}" # trim 4.0.0 -> 4.0, 4.1.0 -> 4.1
    
      265      # prevent the mksrcinfo bash emulator from getting these vars!
    
      266      #eval 'conf''licts+=("linux>${_kernelversionsmall}" "linux<${_kernelversionsmall}")'
    
      267      eval 'dep''ends+=("linux=${_kernelversionsmall}")'
    
      268    fi
    
      269  else
    
      270    depends+=('dkms')
    
      271    conflicts+=('zfs-linux-headers')
    
      272    #depends+=('lsb-release') # patched away
    
      273    _del_modules
    
      274    pushd "${srcdir}/dkms.Arch" > /dev/null
    
      275    local _dkmsdir="${pkgdir}/usr/src/zfs-${_pkgver}"
    
      276    install -d "${_dkmsdir}"/{config,scripts}
    
      277    cp -a configure dkms.conf Makefile.in META zfs_config.h.in zfs.release.in include/ module/ "${_dkmsdir}"/
    
      278    cp config/config.* config/missing config/*sh "${_dkmsdir}"/config/
    
      279    cp scripts/enum-extract.pl scripts/dkms.postbuild "${_dkmsdir}"/scripts/
    
      280    popd > /dev/null
    
      281  fi
    
      282}
    
      283_z="$(declare -f package_zfs-linux-git)"; eval "${_z//-git/}"
    
      284
    
      285_fix_modules() {
    
      286  pushd "${pkgdir}" > /dev/null
    
      287  install -d 'usr/lib'
    
      288  mv lib/* 'usr/lib/'
    
      289  rmdir 'lib'
    
      290  popd > /dev/null
    
      291}
    
      292
    
      293_del_utils() {
    
      294  pushd "${pkgdir}" > /dev/null
    
      295  if [ -d 'usr/share' ]; then
    
      296    mv 'usr/lib/modules' .
    
      297    mv 'usr/src' .
    
      298    rm -r 'etc' 'usr'
    
      299    install -d 'usr/lib'
    
      300    mv 'src' 'usr/'
    
      301    mv 'modules' 'usr/lib/'
    
      302  fi
    
      303  popd > /dev/null
    
      304}
    
      305
    
      306_del_headers() {
    
      307  pushd "${pkgdir}" > /dev/null
    
      308  rm -r 'usr/src'
    
      309  popd > /dev/null
    
      310}
    
      311
    
      312_del_modules() {
    
      313  pushd "${pkgdir}" > /dev/null
    
      314  rm -r 'usr/lib/modules'
    
      315  rmdir --ignore-fail-on-non-empty -p 'usr/lib'
    
      316  popd > /dev/null
    
      317}
    
      318
    
      319package_zfs-utils-git() {
    
      320  local -; set -u
    
      321  pkgdesc='Userspace utilities for the Zettabyte File System.'
    
      322  depends=('systemd')
    
      323  optdepends=(
    
      324    'python: for arcstat/arc_summary/dbufstat'
    
      325  )
    
      326  provides=("${pkgname%-git}=${pkgver%%.r*}")
    
      327  conflicts=("${pkgname%-git}")
    
      328  cd "${_srcdir}"
    
      329
    
      330  cp -rp "${srcdir}/inst"/* "${pkgdir}"
    
      331
    
      332  _fix_utils
    
      333  _fix_modules
    
      334  _del_modules
    
      335  _del_headers
    
      336}
    
      337_z="$(declare -f package_zfs-utils-git)"; eval "${_z//-git/}"
    
      338
    
      339_fix_utils() {
    
      340  install -D -m644 contrib/bash_completion.d/zfs "${pkgdir}"/usr/share/bash-completion/completions/zfs
    
      341
    
      342  # Fix for permissions being overwritten on /dev/zfs. Related issues:
    
      343  # https://github.com/openzfs/zfs/issues/15146
    
      344  # https://github.com/systemd/systemd/issues/28653
    
      345  install -D -m644 "${srcdir}"/zfs-node-permission.conf "${pkgdir}"/usr/lib/tmpfiles.d/zfs-node-permission.conf
    
      346
    
      347  # Remove uneeded files
    
      348  rm -r "${pkgdir}"/etc/init.d
    
      349  rm -fr "${pkgdir}"/etc/sudoers.d #???
    
      350  # We're experimenting with dracut in [extra], so start installing this.
    
      351  #rm -r "${pkgdir}"/usr/lib/dracut
    
      352  rm -r "${pkgdir}"/usr/lib/modules-load.d
    
      353  rm -r "${pkgdir}"/usr/share/initramfs-tools
    
      354  rm -r "${pkgdir}"/usr/share/zfs/zfs-tests # For zpool set compatibility
    
      355
    
      356  install -D -m644 "${srcdir}"/zfs.initcpio.hook "${pkgdir}"/usr/lib/initcpio/hooks/zfs
    
      357  install -D -m644 "${srcdir}"/zfs.initcpio.install "${pkgdir}"/usr/lib/initcpio/install/zfs
    
      358  install -D -m644 "${srcdir}"/zfs.initcpio.zfsencryptssh.install "${pkgdir}"/usr/lib/initcpio/install/zfsencryptssh
    
      359}
    
      360
    
      361package_zfs-linux-git-headers() {
    
      362  local -; set -u
    
      363  pkgdesc='Kernel headers for the Zettabyte File System.'
    
      364  depends=("zfs-utils=${_pkgver}")
    
      365  provides=("zfs-headers=${_pkgver}" "zfs-linux-headers=${_pkgver}" "spl-headers=${_pkgver}")
    
      366  conflicts=('zfs-headers' 'zfs-dkms' 'zfs-dkms-git' 'zfs-dkms-rc' 'spl-dkms' 'spl-dkms-git' 'spl-headers')
    
      367
    
      368  cd "${_srcdir}"
    
      369  cp -rp "${srcdir}/inst"/* "${pkgdir}/"
    
      370
    
      371  _fix_modules
    
      372  _del_utils
    
      373  _del_modules
    
      374
    
      375  # Remove reference to ${srcdir}
    
      376  _fn_calc_extramodules
    
      377  sed -e "s+${srcdir}++" -i "${pkgdir}"/usr/src/zfs-*/${_extramodules}/Module.symvers
    
      378}
    
      379_z="$(declare -f package_zfs-linux-git-headers)"; eval "${_z//-git/}"
    
      380unset _z
    
      381
    
      382set +u
    
      383

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2