udev: Add uaccess tag to coldcard rules
What the developer wrote
Authored by Ava Chow
udev: Add uaccess tag to coldcard rules
Since systemd 258, uaccess is required for normal users to access
devices.
What changed, and why it matters
This commit updates the Linux device rules for the Coldcard hardware wallet so that normal users can access the device on newer Linux systems that use systemd 258 or later. Without this change, the wallet might not be detected or usable by non-admin users after upgrading their operating system. It is a compatibility/usability fix, not a fix for an active security vulnerability.
No immediate security action is required. Users and packagers should apply this commit to ensure Coldcard hardware wallets remain usable on systems with systemd 258+. Review whether MODE=0666 is still appropriate, as uaccess alone may be sufficient for least-privilege access on modern systems.
Security signals we found
udev rule change affecting device access permissions
systemd 258 compatibility requirement for uaccess tag
retains permissive MODE=0666 and GROUP=plugdev settings
Evidence from the diff
The patch adds TAG+=”uaccess” to two udev rules in hwilib/udev/51-coinkite.rules for Coldcard devices (USB VID/PID d13e:cc10). Starting with systemd 258, the uaccess tag is needed for logind to grant seat-local users access to devices, even when traditional GROUP/MODE permissions are set. The change prevents permission denials for non-root users running HWI on recent distributions. The rules still retain GROUP=”plugdev” and MODE=”0666”, so the effective access model is broadened only by restoring the intended user access under newer systemd behavior.
Changed components
hwilib/udev/51-coinkite.rulesInspect captured patch +2 / −2
diff --git a/hwilib/udev/51-coinkite.rules b/hwilib/udev/51-coinkite.rules
index 27527c8..3917e61 100644
--- a/hwilib/udev/51-coinkite.rules
+++ b/hwilib/udev/51-coinkite.rules
@@ -1,8 +1,8 @@
# probably not needed:
-SUBSYSTEMS=="usb", ATTRS{idVendor}=="d13e", ATTRS{idProduct}=="cc10", GROUP="plugdev", MODE="0666"
+SUBSYSTEMS=="usb", ATTRS{idVendor}=="d13e", ATTRS{idProduct}=="cc10", GROUP="plugdev", MODE="0666", TAG+="uaccess"
# required:
# from <https://github.com/signal11/hidapi/blob/master/udev/99-hid.rules>
-KERNEL=="hidraw*", ATTRS{idVendor}=="d13e", ATTRS{idProduct}=="cc10", GROUP="plugdev", MODE="0666"
+KERNEL=="hidraw*", ATTRS{idVendor}=="d13e", ATTRS{idProduct}=="cc10", GROUP="plugdev", MODE="0666", TAG+="uaccess"
Why this scored 26/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.