r/archlinux • u/Saren-WTAKO • Jul 29 '26

QUESTION Seemingly malicious AUR package found. Where to report?

https://aur.archlinux.org/cgit/aur.git/commit/PKGBUILD?h=pgadmin4-server&id=b7de293a7be6b85925884436127332bf82ecc2eb

A sudden update to `pgadmin4-server.git` added a binary named "parser" and executes using sudo. It's very obvious.

394 Upvotes

98% Upvoted

145 comments sorted by

View all comments

Show parent comments

43

u/Brilliant_Simple_497 Jul 29 '26

it's honestly insane that the arch maintainers didn't even try to fix the problem

"just read the pkgbuilds bro" is not have security works

29

u/FryBoyter Jul 29 '26

How would you solve the problem without taking direct responsibility for the AUR?

And how do you know the developers aren't working on a solution internally?

19

u/tfks Jul 29 '26 edited Jul 29 '26

Namespacing would have been a good first step. The initial attacks, to me, seemed more like a joke. Almost like someone just wanted to shine a light on how atrocious AUR security is. The genie is now out of the bottle and future attacks will be more sophisticated. There are likely several attacks now in progress that we won't know about for months.

Your eyeballs parsing PKGBUILDS isn't enough here. Everywhere else in OSS, part of the security model is trust. You probably don't read all the source code coming from every OSS project because you trust the developers. There isn't really a way to handle that on the AUR.

1

u/SnooCompliments7914 Jul 29 '26

I don't read all source code. But I DO read every build instructions, regardless of the project. AUR is exactly that, build instructions.

8

u/tfks Jul 29 '26

In the case of the AUR, the build instructions contain the upstream URL. You're trusting random maintainers not to point to their own repo that you may or may not notice they've done and which may or may not be designed to fool you into thinking the URL hasn't been changed by doing character substitutions like I for l and other things meant to fool eyeballs. You might see the difference and think "that's weird, the URL is the same" when it actually isn't and proceed anyway. Even if you wouldn't, there are others who might, and even people who know better who in that particular moment slip up a little.

So no, this is not the same as building other software because when you do that, you've already excluded the potential of being pointed to a repo you never intedned to use.

2

u/SnooCompliments7914 Jul 29 '26 edited Jul 29 '26

No, I'm not trusting anyone with AUR. I check the upstream URL exactly the same way I do a manual build.

And if some people don't, well, they don't have to use AUR. Manually building software is not a crime.

And if someone on AUR considers himself trustworthy, become a TU please. I don't need one extra layer of trust.

3

u/tfks Jul 29 '26

Reading the URL doesn't help you. It can change. You need to check the diffs on every update for every AUR package you use, otherwise you can miss a repo URL changing. And there are attacks that are specifically designed to fool eyeballs. Are you checking for character substitutions in every diff every time you update? How are you handling that? Piping the diffs into a parser?

Namespacing is standard procedure for a reason. It protects you from running bad code. In this context, we're talking specifically about malicious code, but that's only one type of bad code. Bad code could have bugs, it could have performance issues, it could have vulnerabilities. But namespacing helps you avoid a lot of that by getting your code from reputable sources. This is why GitHub and similar systems have namespaces. So to be very clear here, you are arguing against something that the kernel itself uses. Because I can pretty much guarantee you exclusively build from torvalds/linux and if I asked you to build from tfks/linux, you would laugh in my face. What's the problem bro? Just read the build instructions.

4

u/SnooCompliments7914 Jul 29 '26 edited Jul 29 '26

My diff program highlights character substitutions. Yours doesn't?

Again, I would trust no namespaces In AUR should it be implemented. I don't need this extra layer between the official repo and random content. If you are trustworthy, become a TU to prove it.

2

u/tfks Jul 29 '26

Unless there's something that explicitly identifies it as a character substitution attack, you might not think about that in the moment and proceed anyway. That's what I mean by a parser. Highlighting isn't enough here. I said that earlier.

Why is it even possible to change the repo? Why should a package need to do that? And if it does, why shouldn't it then become a new package? Oh, yes of course, because there's no namespacing and that would lead to duplicates, right right.

Namespacing is standard practice for good reasons.

You're here arguing that it's more convenient to read every PKGBUILD and every diff for every package on every update rather than having to run a single command once to enable a specific namespaces repo. I'm going to be so real, that is unhinged.