utility provides an interface to
manipulate properties of devfs(5)
argument determines the context for
the rest of the arguments. For example, most of the commands related to the
rule subsystem must be preceded by the rule
keyword. The following flags are common to all keywords:
- Operate on mount-point,
which is expected to be a devfs(5) mount. If
this option is not specified, devfs operates
rule subsystem provides a way for the
administrator of a system to control the attributes of DEVFS nodes. Each DEVFS
mount-point has a “ruleset”, or a list of rules, associated with
it. When a device driver creates a new node, all the rules in the ruleset
associated with each mount-point are applied (see below) before the node
becomes visible to the userland. This permits the administrator to change the
properties, including the visibility, of certain nodes. For example, one might
want to hide all disk nodes in a jail(2)
Rule manipulation commands follow the rule
The following flags are common to all of the rule manipulation commands:
- Operate on the ruleset with the number
ruleset. If this is not specified, the
commands operate on the ruleset currently associated with the specified
The following commands are recognized:
- Add the rule described by
rulespec (defined below) to the ruleset.
The rule has the number rulenum if it is
explicitly specified; otherwise, the rule number is automatically
determined by the kernel.
apply rulenum |
- Apply rule number rulenum
or the rule described by rulespec to the
mount-point. Rules that are “applied” have their conditions
checked against all nodes in the mount-point and the actions taken if they
- Apply all the rules in the ruleset to the mount-point (see
above for the definition of “apply”).
- Delete rule number rulenum
from the ruleset.
- Delete all rules from the ruleset.
- Display the rule number
rulenum, or all the rules in the ruleset.
The output lines (one line per rule) are expected to be valid
- Report the numbers of existing rulesets.
- Set ruleset number ruleset
as the current ruleset for the mount-point.
Rules have two parts: the conditions and the actions. The conditions determine
which DEVFS nodes the rule matches and the actions determine what should be
done when a rule matches a node. For example, a rule can be written that sets
the GID to “
” for all devices of
type tape. If the first token of a rule specification is a single dash
’), rules are read from the
standard input and the rest of the specification is ignored.
The following conditions are recognized. Conditions are ANDed together when
matching a device; if OR is desired, multiple rules can be written.
- Matches any node with a path that matches
pattern, which is interpreted as a
- Matches any node that is of type
devtype. Valid types are
The following actions are recognized. Although there is no explicit delimiter
between conditions and actions, they may not be intermixed.
- Set the GID of the node to
gid, which may be a group name (looked up
in /etc/group) or number.
- Hide the node. Nodes may later be revived manually with
mknod(8) or with the
unhide action. Hiding a directory node
effectively hides all of its child nodes.
- Apply all the rules in ruleset number
ruleset to the node. This does not
necessarily result in any changes to the node (e.g., if none of the rules
in the included ruleset match). Include commands in the referenced
ruleset are not resolved.
- Set the file mode to
filemode, which is interpreted as in
- Set the UID to uid, which
may be a user name (looked up in /etc/passwd)
- Unhide the node. If the node resides in a subdirectory, all
parent directory nodes must be visible to be able to access the node.
Rulesets are created by the kernel at the first reference and destroyed when the
last reference disappears. E.g., a ruleset is created when a rule is added to
it or when it is set as the current ruleset for a mount-point, and a ruleset
is destroyed when the last rule in it is deleted and no other references to it
exist (i.e., it is not included by any rules and it is not the current ruleset
for any mount-point).
Ruleset number 0 is the default ruleset for all new mount-points. It is always
empty, cannot be modified or deleted, and does not show up in the output of
Rules and rulesets are unique to the entire system, not a particular
mount-point. I.e., a showsets
will return the
same information regardless of the mount-point specified with
. The mount-point is only relevant when
changing what its current ruleset is or when using one of the apply commands.
- Default devfs configuration
- Local devfs configuration
file. Rulesets in here override those in
/etc/defaults/devfs.rules with the same
ruleset number, otherwise the two files are effectively merged.
- Boot-time devfs configuration
- Example boot-time devfs
When the system boots, the only ruleset that exists is ruleset number 0; since
the latter may not be modified, we have to create another ruleset before
adding rules. Note that since most of the following examples do not specify
, the operations are performed on
(this only matters for things that might
change the properties of nodes).
Specify that ruleset 10 should be the current ruleset for
(if it does not already exist, it is
devfs ruleset 10
Add a rule that causes all nodes that have a path that matches
” (this is only
) to have the file mode 666 (read and
write for all). Note that if any such nodes already exist, their mode will not
be changed unless this rule (or ruleset) is explicitly applied (see below).
The mode will
be changed if the node is created
the rule is added (e.g., the
module is loaded after the above rule
devfs rule add path speaker mode
Apply all the rules in the current ruleset to all the existing nodes. E.g., if
the below rule was added after /dev/speaker
created, this command will cause its file mode to be changed to 666 as
prescribed by the rule:
devfs rule applyset
For all devices with a path that matches
”, set the file mode to 660 and the
GID to “
”. This permits users in
” group to use the
devices (quoting the argument to
is often necessary to disable the shell's
devfs rule add path snp* mode 660 group
Add a rule to ruleset number 20. Since this ruleset is not the current ruleset
for any mount-points, this rule is never applied automatically (unless ruleset
20 becomes a current ruleset for some mount-point at a later time):
devfs rule -s 20 add type disk group
Explicitly apply all rules in ruleset number 20 to the DEVFS mount on
. It does not matter that ruleset 20
is not the current ruleset for that mount-point; the rules are still applied:
devfs -m /my/jail/dev rule -s 20
Since the following rule has no conditions, the action
) will be applied to all nodes:
devfs rule apply hide
Since hiding all nodes is not very useful, we can undo it. The following applies
to all the nodes, causing them to
devfs rule apply unhide
Add all the rules from the file my_rules
devfs rule -s 10 add - <
The below copies all the rules from ruleset 20 into ruleset 10. The rule numbers
are preserved, but ruleset 10 may already have rules with non-conflicting
numbers (these will be preserved). Since show
outputs valid rules, this feature can be used to copy rulesets:
devfs rule -s 20 show | devfs rule -s 10 add