← Watch feed

Informational 19 Bitcoin Committed Jul 31, 2026 · 19:12 UTC

udev: Remove group from rules

Bitcoin Core/Hardware Wallet Interface

46398257 View source ↗

Public commit record

What the developer wrote

Authored by Ava Chow

60/100 · Adequate

udev: Remove group from rules

Since systemd 258, setting the group to a non-system group is no longer
supported.

✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body

The short version

What changed, and why it matters

This commit removes the 'plugdev' group assignment from Linux udev rules that grant user access to Bitcoin hardware wallets. The change is a compatibility fix for newer systemd versions (258+), which no longer allow non-system groups in udev rules. It is not a security vulnerability fix; if anything, removing group-based access slightly tightens access control by relying on the 'uaccess' tag instead.

Recommended action

No security response required. Users and packagers should verify that the updated udev rules still grant their desktop session access to hardware wallets via loginctl/uaccess on systemd 258+ systems, and that non-systemd or older distributions continue to work as expected.

Security signals we found

udev rules modified

GROUP attribute removed

Access mode preserved (0660/0666)

uaccess tag retained

Compatibility fix for systemd 258

Technical analysis

Evidence from the diff

The patch updates four udev rule files for Coinkite, Trezor, KeepKey, and Blockstream Jade devices by deleting the GROUP=”plugdev” directive from every rule. The files retain MODE (0660 or 0666) and TAG+=”uaccess” (plus udev-acl where present). systemd 258 reportedly rejects non-system groups in udev rules, so this change prevents rule parse failures. The access-control model shifts from group ownership to the uaccess/udev-acl mechanism, which is the modern recommended approach for user-local device access.

Changed components

hwilib/udev/51-coinkite.ruleshwilib/udev/51-trezor.ruleshwilib/udev/51-usb-keepkey.ruleshwilib/udev/55-usb-jade.rules

Inspect captured patch +14 / −14

diff --git a/hwilib/udev/51-coinkite.rules b/hwilib/udev/51-coinkite.rules
index 3917e61..1c2f36d 100644
--- a/hwilib/udev/51-coinkite.rules
+++ b/hwilib/udev/51-coinkite.rules
@@ -1,8 +1,8 @@
 
 # probably not needed:
-SUBSYSTEMS=="usb", ATTRS{idVendor}=="d13e", ATTRS{idProduct}=="cc10", GROUP="plugdev", MODE="0666", TAG+="uaccess"
+SUBSYSTEMS=="usb", ATTRS{idVendor}=="d13e", ATTRS{idProduct}=="cc10", MODE="0666", TAG+="uaccess"
 
 # required:
 # from <https://github.com/signal11/hidapi/blob/master/udev/99-hid.rules>
-KERNEL=="hidraw*", ATTRS{idVendor}=="d13e", ATTRS{idProduct}=="cc10", GROUP="plugdev", MODE="0666", TAG+="uaccess"
+KERNEL=="hidraw*", ATTRS{idVendor}=="d13e", ATTRS{idProduct}=="cc10", MODE="0666", TAG+="uaccess"
 
diff --git a/hwilib/udev/51-trezor.rules b/hwilib/udev/51-trezor.rules
index 50472b9..2d6292e 100644
--- a/hwilib/udev/51-trezor.rules
+++ b/hwilib/udev/51-trezor.rules
@@ -8,10 +8,10 @@
 # depending on your distribution
 
 # TREZOR
-SUBSYSTEM=="usb", ATTR{idVendor}=="534c", ATTR{idProduct}=="0001", MODE="0660", GROUP="plugdev", TAG+="uaccess", TAG+="udev-acl", SYMLINK+="trezor%n"
-KERNEL=="hidraw*", ATTRS{idVendor}=="534c", ATTRS{idProduct}=="0001",  MODE="0660", GROUP="plugdev", TAG+="uaccess", TAG+="udev-acl"
+SUBSYSTEM=="usb", ATTR{idVendor}=="534c", ATTR{idProduct}=="0001", MODE="0660", TAG+="uaccess", TAG+="udev-acl", SYMLINK+="trezor%n"
+KERNEL=="hidraw*", ATTRS{idVendor}=="534c", ATTRS{idProduct}=="0001",  MODE="0660", TAG+="uaccess", TAG+="udev-acl"
 
 # TREZOR v2
-SUBSYSTEM=="usb", ATTR{idVendor}=="1209", ATTR{idProduct}=="53c0", MODE="0660", GROUP="plugdev", TAG+="uaccess", TAG+="udev-acl", SYMLINK+="trezor%n"
-SUBSYSTEM=="usb", ATTR{idVendor}=="1209", ATTR{idProduct}=="53c1", MODE="0660", GROUP="plugdev", TAG+="uaccess", TAG+="udev-acl", SYMLINK+="trezor%n"
-KERNEL=="hidraw*", ATTRS{idVendor}=="1209", ATTRS{idProduct}=="53c1",  MODE="0660", GROUP="plugdev", TAG+="uaccess", TAG+="udev-acl"
+SUBSYSTEM=="usb", ATTR{idVendor}=="1209", ATTR{idProduct}=="53c0", MODE="0660", TAG+="uaccess", TAG+="udev-acl", SYMLINK+="trezor%n"
+SUBSYSTEM=="usb", ATTR{idVendor}=="1209", ATTR{idProduct}=="53c1", MODE="0660", TAG+="uaccess", TAG+="udev-acl", SYMLINK+="trezor%n"
+KERNEL=="hidraw*", ATTRS{idVendor}=="1209", ATTRS{idProduct}=="53c1",  MODE="0660", TAG+="uaccess", TAG+="udev-acl"
diff --git a/hwilib/udev/51-usb-keepkey.rules b/hwilib/udev/51-usb-keepkey.rules
index 6e38213..11e56b8 100644
--- a/hwilib/udev/51-usb-keepkey.rules
+++ b/hwilib/udev/51-usb-keepkey.rules
@@ -3,9 +3,9 @@
 # Put this file into /usr/lib/udev/rules.d or /etc/udev/rules.d
 
 # KeepKey HID Firmware/Bootloader
-SUBSYSTEM=="usb", ATTR{idVendor}=="2b24", ATTR{idProduct}=="0001", MODE="0666", GROUP="plugdev", TAG+="uaccess", TAG+="udev-acl", SYMLINK+="keepkey%n"
-KERNEL=="hidraw*", ATTRS{idVendor}=="2b24", ATTRS{idProduct}=="0001",  MODE="0666", GROUP="plugdev", TAG+="uaccess", TAG+="udev-acl"
+SUBSYSTEM=="usb", ATTR{idVendor}=="2b24", ATTR{idProduct}=="0001", MODE="0666", TAG+="uaccess", TAG+="udev-acl", SYMLINK+="keepkey%n"
+KERNEL=="hidraw*", ATTRS{idVendor}=="2b24", ATTRS{idProduct}=="0001",  MODE="0666", TAG+="uaccess", TAG+="udev-acl"
 
 # KeepKey WebUSB Firmware/Bootloader
-SUBSYSTEM=="usb", ATTR{idVendor}=="2b24", ATTR{idProduct}=="0002", MODE="0666", GROUP="plugdev", TAG+="uaccess", TAG+="udev-acl", SYMLINK+="keepkey%n"
-KERNEL=="hidraw*", ATTRS{idVendor}=="2b24", ATTRS{idProduct}=="0002",  MODE="0666", GROUP="plugdev", TAG+="uaccess", TAG+="udev-acl"
+SUBSYSTEM=="usb", ATTR{idVendor}=="2b24", ATTR{idProduct}=="0002", MODE="0666", TAG+="uaccess", TAG+="udev-acl", SYMLINK+="keepkey%n"
+KERNEL=="hidraw*", ATTRS{idVendor}=="2b24", ATTRS{idProduct}=="0002",  MODE="0666", TAG+="uaccess", TAG+="udev-acl"
diff --git a/hwilib/udev/55-usb-jade.rules b/hwilib/udev/55-usb-jade.rules
index f3954cf..ff18abf 100644
--- a/hwilib/udev/55-usb-jade.rules
+++ b/hwilib/udev/55-usb-jade.rules
@@ -1,3 +1,3 @@
-KERNEL=="ttyUSB*", SUBSYSTEMS=="usb", ATTRS{idVendor}=="10c4", ATTRS{idProduct}=="ea60", MODE="0660", GROUP="plugdev", TAG+="uaccess", TAG+="udev-acl", SYMLINK+="jade%n"
-KERNEL=="ttyACM*", SUBSYSTEMS=="usb", ATTRS{idVendor}=="1a86", ATTRS{idProduct}=="55d4", MODE="0660", GROUP="plugdev", TAG+="uaccess", TAG+="udev-acl", SYMLINK+="jade%n"
-KERNEL=="ttyACM*", SUBSYSTEMS=="usb", ATTRS{idVendor}=="303a", ATTRS{idProduct}=="4001", MODE="0660", GROUP="plugdev", TAG+="uaccess", TAG+="udev-acl", SYMLINK+="jade%n"
+KERNEL=="ttyUSB*", SUBSYSTEMS=="usb", ATTRS{idVendor}=="10c4", ATTRS{idProduct}=="ea60", MODE="0660", TAG+="uaccess", TAG+="udev-acl", SYMLINK+="jade%n"
+KERNEL=="ttyACM*", SUBSYSTEMS=="usb", ATTRS{idVendor}=="1a86", ATTRS{idProduct}=="55d4", MODE="0660", TAG+="uaccess", TAG+="udev-acl", SYMLINK+="jade%n"
+KERNEL=="ttyACM*", SUBSYSTEMS=="usb", ATTRS{idVendor}=="303a", ATTRS{idProduct}=="4001", MODE="0660", TAG+="uaccess", TAG+="udev-acl", SYMLINK+="jade%n"

Risk score

Why this scored 19/100

Our methodology →

Potential impact 2/30

Exploitability 1/25

Stealth signal 1/15

Affected reach 3/15

Confidence 8/10

Evidence quality 4/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 19/100

Community notes

Related watches

Merge bitcoin-core/HWI#819: Drop Python 3.9, use 3.10 for dist, bump Ledger

Drop Ledger deny rule from tests

Skip archiving hwi-qt on non-x86 platforms