/dev

devices, as files

/dev is where devices appear as files. A disk, a terminal, a source of random numbers — each has a name here that programs open, read and write like any file. The kernel creates the entries as hardware is found, and what is written to one goes straight to the device.

A disk is a file. So is a terminal. So is nothing at all.

Holds

Device files

Disks, terminals, pseudo-devices

On disk

Kept in memory, filled in by udev

Who writes

The kernel

Entries appear as hardware does

Two kinds

Block and character

Disks, and streams such as terminals

Why it exists

Every directory at the top of the tree is there for a reason. This is the problem /dev solves.

One way to talk to everything

A program that can write to a file can write to a disk, a serial port or a printer. No separate interface is needed for each kind of hardware.

Useful devices that are not hardware

Some entries are provided by the kernel itself: one that discards whatever is written to it, one that supplies endless zeros, one that supplies random bytes.

What you find inside

Not everything, but the entries worth recognising. Each is marked as a directory, a file, a link or a device.

/dev

sdadeviceThe first disk. Its partitions are sda1, sda2 and so on.
nvme0n1deviceThe first NVMe solid-state drive.
nulldeviceDiscards everything written to it. Reading it gives nothing.
zerodeviceSupplies as many zero bytes as are asked for.
urandomdeviceSupplies random bytes — for keys and passwords.
ttydeviceThe terminal the current process is attached to.

At the terminal

Four commands that show what this directory is doing on a real machine.

lsblk

List the disks and partitions, with where each is mounted.

command > /dev/null 2>&1

Run a command and throw away everything it prints.

head -c 16 /dev/urandom | base64

Produce 16 random bytes as readable text.

ls -l /dev/sda

The first letter of the listing is b for a block device, c for a character device.

Handle with care

What goes wrong here, and what someone securing or attacking the machine looks at.

Writing to a disk device destroys it

Output sent to /dev/sda overwrites the disk from its first byte, filesystem and all. With dd, check the of= name against lsblk before running it.

Disk names can change

sda and sdb are handed out in the order disks are found, which can differ between boots. Configuration should refer to a filesystem by its UUID instead.

Read alongside

/sysHardware and drivers as the kernel sees them, presented as files./procRunning processes and kernel state, presented as files./mntAn empty directory where an administrator attaches a filesystem by hand.