I've recently noticed some changes to the
/etc/gshadow files on my Arch Linux system, which were presumably caused by a system upgrade:
+kvm:x:992: # group +kvm:!!:: # gshadow
How can I determine which package created that group?
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.Sign up to join this community
With that specific group, the package is
libvirt. But as you can see from the PKGBUILD it is not the package that creates the group, but the application. pacman would have told you this when you installed it.
pacman has its own concept of groups, but they refer to groups of packages, not user groups. So there is no guaranteed or simple way to immediately determine which package altered
/etc/shadow. Your best bet would be to query the database to determine which package owns the binary referred to in those files, and then investigate from there:
pacman -Ss kvm community/libvirt 3.5.0-1 API for controlling virtualization engines (openvz,kvm,qemu,virtualbox,xen,etc)