[arch-general] Why is it dangerous to run makepkg as root?

Doug Newgard scimmia at archlinux.info
Sun May 18 01:36:37 EDT 2014

On 2014-05-17 15:49, Bardur Arantsson wrote:
> On 2014-05-17 22:08, Bardur Arantsson wrote:
>> On 2014-05-17 21:50, Roland Tapken wrote:
>>> Hi Bardur,
>>> Even if your assumption about pacman is correct: Just let the 
>>> malicious
>>> PKGBUILD write a file into /etc/cron.d/, /etc/systemd or something 
>>> like that
>>> and you're doomed. No need for privilege escalation.
>> Ah, yes. True, of course. I knew I'd missed something! :)
> Hm. Rethinking this I was going to say something about listing (and
> screening) all the files that a package *would* install, but it seems
> that it's not possible to list files installed by a package before
> installing it...?
> (pacman -Ql only accepts installed packages, apparently.)
> Regards,

Use the -p option, ie pacman -Qlp <packagefile>

More information about the arch-general mailing list