ensure plugdev is added as a system group
What the developer wrote
Authored by Craig Raw
ensure plugdev is added as a system group
What changed, and why it matters
This commit changes how the Linux installer creates the 'plugdev' group. Previously it created a normal user group; now it creates it as a system group using the -r flag. System groups are intended for services and hardware access, and using one here is more conventional for a group that grants device access. The change is a packaging/installation hardening improvement, not a fix for an active exploit.
No immediate action required. This is a low-risk hardening change. Users installing or updating Sparrow on Linux will benefit from the plugdev group being created as a system group, which is more appropriate for hardware device access.
Security signals we found
Group creation changed from regular to system group
No change to permissions, udev rules, or application code paths
Packaging/installation hardening only
Evidence from the diff
The patch modifies three Linux packaging/installation locations (postinst, RPM spec, and in-app AppController.java) to add the -r flag when creating the plugdev group. On Linux, groupadd -r creates a group in the system GID range (< 1000), whereas without -r it may create a regular user group. The plugdev group is used to grant users access to USB hardware wallets via udev rules. The change aligns the group type with its purpose but does not alter permissions, access controls, or application logic.
Changed components
src/main/deploy/package/linux/postinstsrc/main/deploy/package/linux/sparrowwallet.specsrc/main/java/com/sparrowwallet/sparrow/AppController.javaInspect captured patch +4 / −4
diff --git a/src/main/deploy/package/linux/postinst b/src/main/deploy/package/linux/postinst
index 6f6f10b..76e71e1 100755
--- a/src/main/deploy/package/linux/postinst
+++ b/src/main/deploy/package/linux/postinst
@@ -26,7 +26,7 @@ case "$1" in
xdg-mime install /opt/sparrowwallet/lib/sparrowwallet-Sparrow-MimeInfo.xml
install -D -m 644 /opt/sparrowwallet/lib/runtime/conf/udev/*.rules /etc/udev/rules.d
if ! getent group plugdev > /dev/null; then
- groupadd plugdev
+ groupadd -r plugdev
fi
if ! groups "${SUDO_USER:-$(whoami)}" | grep -q plugdev; then
usermod -aG plugdev "${SUDO_USER:-$(whoami)}"
diff --git a/src/main/deploy/package/linux/sparrowwallet.spec b/src/main/deploy/package/linux/sparrowwallet.spec
index e49e962..99d4d5d 100755
--- a/src/main/deploy/package/linux/sparrowwallet.spec
+++ b/src/main/deploy/package/linux/sparrowwallet.spec
@@ -82,7 +82,7 @@ xdg-desktop-menu install /opt/sparrowwallet/lib/sparrowwallet-Sparrow.desktop
xdg-mime install /opt/sparrowwallet/lib/sparrowwallet-Sparrow-MimeInfo.xml
install -D -m 644 /opt/sparrowwallet/lib/runtime/conf/udev/*.rules /etc/udev/rules.d
if ! getent group plugdev > /dev/null; then
- groupadd plugdev
+ groupadd -r plugdev
fi
if ! groups "${SUDO_USER:-$(whoami)}" | grep -q plugdev; then
usermod -aG plugdev "${SUDO_USER:-$(whoami)}"
diff --git a/src/main/java/com/sparrowwallet/sparrow/AppController.java b/src/main/java/com/sparrowwallet/sparrow/AppController.java
index 27d1486..42f4c91 100644
--- a/src/main/java/com/sparrowwallet/sparrow/AppController.java
+++ b/src/main/java/com/sparrowwallet/sparrow/AppController.java
@@ -583,7 +583,7 @@ public class AppController implements Initializable {
sudo install -m 644 /opt/sparrowwallet/lib/runtime/conf/udev/*.rules /etc/udev/rules.d
sudo udevadm control --reload
sudo udevadm trigger
- sudo groupadd -f plugdev
+ sudo groupadd -f -r plugdev
sudo usermod -aG plugdev `whoami`
""";
String home = System.getProperty(JPACKAGE_APP_PATH);
Why this scored 21/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.