Re: makepkg as user

[Genes Lists]

On 8/1/26 2:02 PM, Ralf Mardorf wrote:

Hi,

if I understand correctly, during the recent attack on the AUR,
PKGBUILDs were manipulated in such a way that they executed a malicious
programme via sudo during the build process.

If that is the case, couldn’t we protect ourselves by using an alias in
the form of

   sudo -k && makepkg

Hey Ralf

I think there's additional possibly severe risks. From:

(a) anything that gets run during the install phase.

  For example of (a) mighty be any install script
  (pre_install(), post_upgrade(), etc).

  Those can do real damage because they're run with root privileges
  on the actual system(s) where a malevolent package is deployed.

and

(b) malicious code run by users of package.
    any evil code thats pulled into the package.




--
Gene

OpenPGP_signature.asc
Description: OpenPGP digital signature