Review Results

Comment

The only change in this .SRCINFO hunk is a pkgrel bump from 1 to 2. No sources, build logic, install scripts, dependencies, or shipped artifacts are modified here, so there is no new security-relevant behavior to assess in this diff alone.

@@ -1,7 +1,7 @@
 pkgbase = pi-hole-core
 	pkgdesc = The Pi-hole is an advertising-aware DNS/Web server. Arch adaptation for lan wide DNS server.
 	pkgver = 6.5
-	pkgrel = 1
+	pkgrel = 2
 	url = https://github.com/pi-hole/pi-hole
 	install = pi-hole-core.install
 	arch = any

Comment

The .SRCINFO change is metadata-only and does not introduce new build or runtime behavior. It removes references to a sudoers backup and logtruncate service/timer plus pihole.sudo from the package metadata, and updates pkgrel and one checksum to match the current PKGBUILD. Based on the surrounding PKGBUILD/install script, the package already ships a root-run post_install that uses sudo and systemd-sysusers, but this change does not add or worsen that behavior. No new sources, commands, or privileges are introduced by this diff alone.

@@ -22,26 +22,19 @@ pkgbase = pi-hole-core
 	conflicts = pi-hole-standalone
 	conflicts = pi-hole-server
 	backup = etc/pihole/pihole.toml
-	backup = etc/sudoers.d/pihole
 	source = pi-hole-core-6.5.tar.gz::https://github.com/pi-hole/pi-hole/archive/refs/tags/v6.5.tar.gz
 	source = arch-core.patch
 	source = pi-hole.tmpfile
 	source = pi-hole-gravity.service
 	source = pi-hole-gravity.timer
-	source = pi-hole-logtruncate.service
-	source = pi-hole-logtruncate.timer
 	source = mimic_basic-install.sh
 	source = piholeDebug.sh
-	source = pihole.sudo
 	sha256sums = 277a1115b3b3b3ee0c115a6496710539709eefcd34fb5015480cd0bf2785b3f7
 	sha256sums = 6dd5182c1b744a76a93a4eb959e5faa15b8d68e825eae4ff8ad2a1e13deb52df
 	sha256sums = d09f9d10ebdfb6db24d4e1abff8cd09519a7b3f3878ef3974c26aa6838f74e7e
-	sha256sums = 9b72d7769036f8f4bb7121968d2ae4bdba427e4b16787ce340205a5f62b45c7c
+	sha256sums = b8f93892c98f8e7cac4890dc510e38e0aa471387868a416fbb01f35576ab0c6f
 	sha256sums = 5228b4f923eab7784952a0fd6da895e7bff2f80a7f91c4a7c6350491dfdbb2e8
-	sha256sums = 88e3c78bbeaf5dc1100df65202ded8207877954a96bdf1b0ab3d9990d9fa759f
-	sha256sums = ff507ce58c9492cce57e947696e1b814469fc2d856a1e303c6e68f98c62ebf46
 	sha256sums = 27288535f7d5e18c73b9fe13aa0bcd78a2fd935cb2e978c70d51b0439c87844f
 	sha256sums = 69a71c29dbe42ef0cbd3655fd7ce5cf04e8a77e27a5b2c3a1fcce0b544223309
-	sha256sums = 4bda286d2776edf43065e49474c156548b7e4cee26603cbba9c67602b3c8a3b5
 
 pkgname = pi-hole-core

Comment

This change only bumps pkgrel from 1 to 2 in PKGBUILD and does not alter sources, build steps, dependencies, install scripts, or packaging behavior. No security-relevant behavior changes are present in the provided diff hunk.

@@ -5,7 +5,7 @@
 pkgname=pi-hole-core
 _pkgname=pi-hole
 pkgver=6.5
-pkgrel=1
+pkgrel=2
 pkgdesc='The Pi-hole is an advertising-aware DNS/Web server. Arch adaptation for lan wide DNS server.'
 arch=('any')
 license=('EUPL-1.2')

Comment

The change removes installation of a sudoers drop-in and the associated logtruncate systemd units from the package, and updates the backup list and checksums accordingly. This reduces privilege-related surface area rather than adding it. The remaining package behavior still includes root-run install script actions and a systemd oneshot service, but those are unchanged by this diff. No new network fetches, privilege escalation, persistence, or obfuscation were introduced in the reviewed hunk.

@@ -16,29 +16,23 @@ optdepends=()
 conflicts=('pi-hole-standalone' 'pi-hole-server')
 provides=('pi-hole-standalone' 'pi-hole-server')
 install=$pkgname.install
-backup=('etc/pihole/pihole.toml' 'etc/sudoers.d/pihole')
+backup=('etc/pihole/pihole.toml')
 
 source=($pkgname-$pkgver.tar.gz::https://github.com/$_pkgname/$_pkgname/archive/refs/tags/v$pkgver.tar.gz
         arch-core.patch
 	    $_pkgname.tmpfile
 	    $_pkgname-gravity.service
 	    $_pkgname-gravity.timer
-	    $_pkgname-logtruncate.service
-	    $_pkgname-logtruncate.timer
 	    mimic_basic-install.sh
 	    piholeDebug.sh
-	    pihole.sudo
 )
 sha256sums=('277a1115b3b3b3ee0c115a6496710539709eefcd34fb5015480cd0bf2785b3f7'
             '6dd5182c1b744a76a93a4eb959e5faa15b8d68e825eae4ff8ad2a1e13deb52df'
             'd09f9d10ebdfb6db24d4e1abff8cd09519a7b3f3878ef3974c26aa6838f74e7e'
-            '9b72d7769036f8f4bb7121968d2ae4bdba427e4b16787ce340205a5f62b45c7c'
+            'b8f93892c98f8e7cac4890dc510e38e0aa471387868a416fbb01f35576ab0c6f'
             '5228b4f923eab7784952a0fd6da895e7bff2f80a7f91c4a7c6350491dfdbb2e8'
-            '88e3c78bbeaf5dc1100df65202ded8207877954a96bdf1b0ab3d9990d9fa759f'
-            'ff507ce58c9492cce57e947696e1b814469fc2d856a1e303c6e68f98c62ebf46'
             '27288535f7d5e18c73b9fe13aa0bcd78a2fd935cb2e978c70d51b0439c87844f'
-            '69a71c29dbe42ef0cbd3655fd7ce5cf04e8a77e27a5b2c3a1fcce0b544223309'
-            '4bda286d2776edf43065e49474c156548b7e4cee26603cbba9c67602b3c8a3b5')
+            '69a71c29dbe42ef0cbd3655fd7ce5cf04e8a77e27a5b2c3a1fcce0b544223309')
 
 prepare() {
   cd "$srcdir"/"$_pkgname"-"$pkgver"

Comment

The change removes installation of a sudoers drop-in and the logtruncate systemd units, and updates the package metadata accordingly. That reduces privilege-related surface area rather than adding it. The remaining package still ships a gravity timer/service that runs as the unprivileged pihole user, and the .install script still uses sudo to run commands as pihole during post_install/post_upgrade, but those behaviors pre-existed this diff and are not introduced here. No new network fetches, obfuscation, or suspicious install-time persistence mechanisms are added by this change.

@@ -69,18 +63,12 @@ package() {
 
   cp -dpr --no-preserve=ownership $_pkgname-$pkgver/advanced/Scripts/database_migration "$pkgdir"/opt/pihole/
 
-  install -dm750 "$pkgdir"/etc/sudoers.d
-  install -Dm440 pihole.sudo "$pkgdir"/etc/sudoers.d/pihole
-
   install -Dm644 pi-hole.tmpfile "$pkgdir"/usr/lib/tmpfiles.d/pi-hole.conf
 
   install -Dm644 "$_pkgname-gravity.timer" "$pkgdir/usr/lib/systemd/system/$_pkgname-gravity.timer"
   install -Dm644 "$_pkgname-gravity.service" $pkgdir/usr/lib/systemd/system/$_pkgname-gravity.service
-  install -Dm644 "$_pkgname-logtruncate.timer" "$pkgdir/usr/lib/systemd/system/$_pkgname-logtruncate.timer"
-  install -Dm644 "$_pkgname-logtruncate.service" $pkgdir/usr/lib/systemd/system/$_pkgname-logtruncate.service
   install -dm755 "$pkgdir/usr/lib/systemd/system/multi-user.target.wants"
   ln -s ../$_pkgname-gravity.timer "$pkgdir/usr/lib/systemd/system/multi-user.target.wants/$_pkgname-gravity.timer"
-  ln -s ../$_pkgname-logtruncate.timer "$pkgdir/usr/lib/systemd/system/multi-user.target.wants/$_pkgname-logtruncate.timer"
 
   install -dm755 "$pkgdir"/etc/pihole
   install -Dm644 $_pkgname-$pkgver/advanced/Templates/logrotate "$pkgdir"/etc/logrotate.d/pihole

Comment

The only change is adding `User=pihole` to the oneshot gravity-update systemd unit. This is a security-positive hardening change: it reduces privilege for the service execution and does not introduce new commands, network access, persistence, or packaging issues. The surrounding package already expects a `pihole` system user and even invokes Pi-hole maintenance scripts as that user in the .install script, so this aligns with existing behavior rather than expanding attack surface.

@@ -4,6 +4,7 @@ Description=Ad-serving domains collector
 [Service]
 Type=oneshot
 ExecStart=/usr/bin/pihole updateGravity
+User=pihole
 Nice=19
 IOSchedulingClass=best-effort
 IOSchedulingPriority=7