I've recently noticed some changes to the /etc/group and /etc/gshadow files on my Arch Linux system, which were presumably caused by a system upgrade:

+kvm:x:992:   # group
+kvm:!!::     # gshadow

How can I determine which package created that group?


With that specific group, the package is libvirt. But as you can see from the PKGBUILD it is not the package that creates the group, but the application. pacman would have told you this when you installed it.

pacman has its own concept of groups, but they refer to groups of packages, not user groups. So there is no guaranteed or simple way to immediately determine which package altered /etc/group or /etc/shadow. Your best bet would be to query the database to determine which package owns the binary referred to in those files, and then investigate from there:

pacman -Ss kvm
  community/libvirt 3.5.0-1
  API for controlling virtualization engines (openvz,kvm,qemu,virtualbox,xen,etc)
| improve this answer | |
  • Amusingly, I don't have libvirt installed: pacman -Qs libvirt shows nothing. And the only file owned by the kvm group is /dev/kvm. – Eugene Yarmash Aug 2 '17 at 8:34
  • @eugeney Odd. It doesn't appear to have been part of the filesystem package in the recent past. Let me dig a little deeper. – jasonwryan Aug 2 '17 at 8:59
  • Apparently, it was systemd that created the group. Check my answer for the details :) – Eugene Yarmash Oct 29 '17 at 9:20

One way is to search the sysusers.d directory, which contains configuration files for systemd-sysusers. In particular, the kvm group is currently created by systemd. This is the commit that introduced that change: 5a664ca1.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.