On 2014-05-17 22:08, Bardur Arantsson wrote: > On 2014-05-17 21:50, Roland Tapken wrote: >> Hi Bardur, >> >> Even if your assumption about pacman is correct: Just let the malicious >> PKGBUILD write a file into /etc/cron.d/, /etc/systemd or something like that >> and you're doomed. No need for privilege escalation. >> > > Ah, yes. True, of course. I knew I'd missed something! :) > Hm. Rethinking this I was going to say something about listing (and screening) all the files that a package *would* install, but it seems that it's not possible to list files installed by a package before installing it...? (pacman -Ql only accepts installed packages, apparently.) Regards,
