How safe is it to activate and use AUR?

alleluia20 · 2009-04-15 19:23:44

Hello,

I am an intermediate-advanced linux user, but I am an Arch newbie. If I did not misunderstand, I read that anyone can load a package in AUR, whereas only the trusted users go into the community repository. First of all, is this correct?

Now, if anyone can upload into AUR, how safe is it to use it? I see at least four cautions:

1) Old packages that can duplicate some software already included in the official packages, but with another name (an example is the power management in KDE4).

2) Old packages that, because of dependencies, can screw pacman's administration.

3) Non-carefully built packages that can make the computer malfunction or open security holes.

4) Intentionally malicious packages that can make the computer malfunction or open security holes (if anyone can upload onto AUR, this is not unrealistic).

Then, again, how safe is it to use AUR? And, what would the reasonable precautions be?

Thank you very much in advance.

Inxsible · 2009-04-15 19:40:55

So long as you read the PKGBUILD and/or install files, if there are any, and you know what it is doing, you should be safe. AUR never has binaries anyway. PKGBUILD is only something that points to the source code, and then helps you install the software. But yes, you do need to be wary of malicious scripts that CAN be added in a package in AUR.

One of the criteria to upload in AUR is to make sure the package does not exist in any other repository. Some users do however upload using different names, but then you don't have to install those anyway. Just doing a search across the repos will let you know if a version is available.

I normally prefer the repo versions before the AUR, unless the repo version is really old and hasn't been updated. This is very uncommon though.

Last edited by Inxsible (2009-04-15 19:43:09)

Xyne · 2009-04-15 19:42:06

Well, first of all, the AUR isn't a repository like core/extra/community, so you can't really "enable" it. You have to build those packages yourself using the PKGBUILDs and local sources uploaded to the AUR. You can use "yaourt" to do this for you transparently though.

Yes, it is correct that anyone can upload packages to the AUR. While the Trusted Users (TUs) are charged with keeping an eye on what gets uploaded, that is in no way a guarantee that packages in the AUR are well formed or not malicious. In practice the AUR seems to be quite safe but in theory it can do some damage, but only if you yourself are not careful. You should always inspect PKGBUILDs and *.install files when building packages from the AUR (yaourt has a dialogue which prompts you to do this).

1) The TUs also try to remove packages in the AUR that are included in core/extra/community so there should be no naming conflicts between the former and the later. The AUR will often contain developmental versions of packages (cvs/svn/git/etc) but they will have modified names (foo-git for example). As for files themselves, pacman detects file conflicts so you never have to worry about overwriting files in one package with files from another package (unless you stupidly use the "--force" option by default, but if you do that, you probably have more serious problems than file conflicts).

2) Pacman handles dependency resolution so this is not an issue (as long as you don't use "--nodeps" and "--force" by default, which you shouldn't).

3) This is why you should check everything yourself. Generally though such things will arise from the source code itself, not the way it's packaged, so that's really an issue for the upstream developers, not the AUR.

4) See above.

Using the AUR is like crossing the street... proceed with caution and you should be fine.

*edit*
Read these if you haven't already:
http://wiki.archlinux.org/index.php/AUR
http://wiki.archlinux.org/index.php/PKGBUILD

Last edited by Xyne (2009-04-15 19:51:01)

mienensuchkind · 2009-04-15 19:45:44

Packages from aur (which are not in community) should be made manually with makepkg.

This solves 1), since if you're not blind you can determine if you build an outdated package...
2): dunno what you mean, pacman doesn't get confused, and as long as you don't replace packages from the repos with outdated ones, you probably won't break any dependencies.
3+4) Thats the deal, if you don't (can't) trust someone, don't be surprised if something goes wrong. Just build packages from AUR if you know what you're doing.

You see, the problems you point out are known, and they are the reason why you have to build packages from AUR manually. You may have heard about Yaourt, which automates this process. Using this makes you lazy and brings risks: But It's still very useful since it asks you always to have a look at the PKGBUILD file, which is the only thing a user uploads to AUR and thus the ony thing somebody can do harm with.

DonVla · 2009-04-15 21:49:15

totally off-topic:
@mienensuchkind: you're name is one of the funniest i've heard!

Last edited by DonVla (2009-04-15 21:49:54)

hokasch · 2009-04-16 00:32:05

/sorry for the offtopic follow-up.../
DonVla, I was travelling in Cambodia recently, and I totally disagree.
/back to silence/

benob · 2009-04-16 01:47:25

Is there any precedent of an AUR package being malicious?

Xyne · 2009-04-16 13:14:50

benob wrote:

Is there any precedent of an AUR package being malicious?

Does this count?

alleluia20 · 2009-04-16 19:05:05

Thanks to you all for your very useful replies.

a) So, if I understood correctly, the AUR packages contain the orders to download the sources (or binaries) from the upstream. Is this correct? Or, does any of the AUR packages contain binaries?

b) One of the main advantages of a repo (know when a new version becomes available) is still possible with yaourt, isn't it?

c) Does yaourt give you the possibility of displaying the files in order for you to read?

d) Checking the PKGBUILD (and the other files: install, etc) may not be so easy if you are not a bash guru, isn't it? For example, I had a look at the files in virtualbox-bin and, if there had been something wrong, I would definitely not had noticed it

Thank you very much again

Inxsible · 2009-04-16 19:44:50

alleluia20 wrote:

Thanks to you all for your very useful replies.
a) So, if I understood correctly, the AUR packages contain the orders to download the sources (or binaries) from the upstream. Is this correct? Or, does any of the AUR packages contain binaries?

Yes it is correct. and no AUR does not contain any binaries, with the exception of some jar files for java based apps here and there...JAR files are technically binary files, but again they are source files, so if it is malicious, then its the developer who is doing it

alleluia20 wrote:

b) One of the main advantages of a repo (know when a new version becomes available) is still possible with yaourt, isn't it?

yes yaourt will tell you if updates are available for any package that you have installed from AUR.

alleluia20 wrote:

c) Does yaourt give you the possibility of displaying the files in order for you to read?

Yes.

alleluia20 wrote:

d) Checking the PKGBUILD (and the other files: install, etc) may not be so easy if you are not a bash guru, isn't it? For example, I had a look at the files in virtualbox-bin and, if there had been something wrong, I would definitely not had noticed it
Thank you very much again

Yes, it could be difficult initially...but over time you will see a pattern and recognize the basic commands. If there is something that you are unsure of, you can ask on the forums or on the AUR page of that package itself via the comments section

Xyne · 2009-04-17 06:42:46

alleluia20 wrote:

Thanks to you all for your very useful replies.
a) So, if I understood correctly, the AUR packages contain the orders to download the sources (or binaries) from the upstream. Is this correct? Or, does any of the AUR packages contain binaries?
b) One of the main advantages of a repo (know when a new version becomes available) is still possible with yaourt, isn't it?
c) Does yaourt give you the possibility of displaying the files in order for you to read?
d) Checking the PKGBUILD (and the other files: install, etc) may not be so easy if you are not a bash guru, isn't it? For example, I had a look at the files in virtualbox-bin and, if there had been something wrong, I would definitely not had noticed it
Thank you very much again

Your questions imply that you haven't read the wiki pages that I linked to or the entirety of the replies in this thread, e.g.
a) If you had followed the link to AUR wiki page, you would have found the AUR User Guidelines page which clearly states that binary packages are not allowed.
c) "You should always inspect PKGBUILDs and *.install files when building packages from the AUR (yaourt has a dialogue which prompts you to do this)."

Please take some time to do a bit of research yourself. All of the information is there to be found. I understand that it's reassuring to get clear answers from others but Arch users are normally encouraged to do a bit of digging on their own before relying on others to answer their questions.

Don't take this the wrong way. I'm happy to help as are most others, but pointing this out prevents people from becoming overly reliant on others and ultimately lazy.

alleluia20 · 2009-04-17 19:15:59

@Inxsible: Thank you very much for your very helpful reply.

@Xyne: I appreciate your feelings, but let me explain: I did read your very useful links and I was just "reassuring to get clear answers", let us say, a double check. Regarding your point a), I suppose I forgot about that point at the end of my reading, it is not easy to digest a lot of new information! Regarding your point b), I understood that yaourt advised you to do that, but I was wondering whether yaourt displayed the files by itself (or I had to read them by another way).

Thank you again.

Xyne · 2009-04-18 06:07:12

alleluia20 wrote:

@Xyne: I appreciate your feelings, but let me explain: I did read your very useful links and I was just "reassuring to get clear answers", let us say, a double check. Regarding your point a), I suppose I forgot about that point at the end of my reading, it is not easy to digest a lot of new information! Regarding your point b), I understood that yaourt advised you to do that, but I was wondering whether yaourt displayed the files by itself (or I had to read them by another way).
Thank you again.

Fair enough.

Yaourt prompts you for an editor to open the files (you can probably configure that in yaourtrc but I've never used it enough to bother, so I don't know). It will then open the file in that editor and let you check it and make any changes before proceeding.

majiq · 2009-05-30 08:33:09

I'm just hijacking this thread because I think it's somewhat relevant to the topic. I'm fairly used to Linux, and very comfortable with Archlinux. I've been using it for the past year and a half or so, and it's been a great time. I only recently started using yaourt to make my life easier, but I've had this one nagging problem since the beginning - I don't know what malicious code would look like, probably. Could someone give an example? Or something to look for maybe? I mean, I've seen enough to know what's roughly "normal", but it still makes me wonder what could wrong.

tomk · 2009-05-30 08:43:29

rm -rf /

That's a very obvious example. If you do not understand it, read the rm man page. The same applies to anything else you see in a PKGBUILD - if you dont understand what you're looking at, do some research. If you're still not comfortable after doing so, stick to approved packages from the official Arch repos.

Allan · 2009-05-30 08:47:21

Remember to look at .install files too... I think they are much more dangerous that the PKGBUILD itself.

alleluia20 · 2009-05-31 01:24:15

Remember to look at .install files too... I think they are much more dangerous that the PKGBUILD itself.

I have six packages from AUR installed so far. In all of them, yaourt just prompted me to read the PKGBUILD. The reason is that those packages did not contain any .install at all, because most packages do not contain .install, isn't it? Can you please kindly confirm?

Also, in case I end up installing a package that has PKGBUILD and .install, will yaourt prompt me to read both of them?

Can you please kindly answer the two questions (I looked the web up but did not find)? Thank you very much in advance.

Last edited by alleluia20 (2009-05-31 01:25:22)

rusty99 · 2009-05-31 05:31:36

Yes to both.
If it requires a .install then yaourt will prompt you to read/edit it as well as PKGBUILD.

moljac024 · 2009-05-31 07:31:13

rusty99 wrote:

Yes to both.
If it requires a .install then yaourt will prompt you to read/edit it as well as PKGBUILD.

There will even be bright red flashing text.

Urfaust · 2009-05-31 11:14:24

majiq wrote:

I'm just hijacking this thread because I think it's somewhat relevant to the topic. I'm fairly used to Linux, and very comfortable with Archlinux. I've been using it for the past year and a half or so, and it's been a great time. I only recently started using yaourt to make my life easier, but I've had this one nagging problem since the beginning - I don't know what malicious code would look like, probably. Could someone give an example? Or something to look for maybe? I mean, I've seen enough to know what's roughly "normal", but it still makes me wonder what could wrong.

Maybe sth. like this: http://en.wikipedia.org/wiki/Fork_bomb
But if someone wants to harm you, don't you think he will obscure his code so you don't find it suspicious?
If you are not sure don't install it and/or ask on the forum. There will always be ways to obfuscate things and so there is no pattern or a set of commands to look at IMO.

Arch Linux

#1 2009-04-15 19:23:44

How safe is it to activate and use AUR?

#2 2009-04-15 19:40:55

Re: How safe is it to activate and use AUR?

#3 2009-04-15 19:42:06

Re: How safe is it to activate and use AUR?

#4 2009-04-15 19:45:44

Re: How safe is it to activate and use AUR?

#5 2009-04-15 21:49:15

Re: How safe is it to activate and use AUR?

#6 2009-04-16 00:32:05

Re: How safe is it to activate and use AUR?

#7 2009-04-16 01:47:25

Re: How safe is it to activate and use AUR?

#8 2009-04-16 13:14:50

Re: How safe is it to activate and use AUR?

#9 2009-04-16 19:05:05

Re: How safe is it to activate and use AUR?

#10 2009-04-16 19:44:50

Re: How safe is it to activate and use AUR?

#11 2009-04-17 06:42:46

Re: How safe is it to activate and use AUR?

#12 2009-04-17 19:15:59

Re: How safe is it to activate and use AUR?

#13 2009-04-18 06:07:12

Re: How safe is it to activate and use AUR?

#14 2009-05-30 08:33:09

Re: How safe is it to activate and use AUR?

#15 2009-05-30 08:43:29

Re: How safe is it to activate and use AUR?

#16 2009-05-30 08:47:21

Re: How safe is it to activate and use AUR?

#17 2009-05-31 01:24:15

Re: How safe is it to activate and use AUR?

#18 2009-05-31 05:31:36

Re: How safe is it to activate and use AUR?

#19 2009-05-31 07:31:13

Re: How safe is it to activate and use AUR?

#20 2009-05-31 11:14:24

Re: How safe is it to activate and use AUR?

Board footer