In this lesson, you will learn how the Linux kernel dynamically handles the appearance and disappearance of hardware devices through the management of device nodes.
The Problem of Dynamic Hardware
In older computing eras, hardware was mostly static; you plugged something in, rebooted, and the system detected it. Today, we rely on "hot-swapping"—plugging in USB drives, external GPUs, or network adapters while the system is running. Because Linux treats everything as a file, every physical device needs a corresponding "device node" (a special file in the /dev directory) so that applications can interact with it.
If you had to manually create these nodes every time you plugged in a mouse, the system would be unusable. Instead, the Linux kernel manages this dynamically.
The Role of udev
When you plug in a device, the kernel detects it and generates a "uevent." This event is intercepted by a userspace daemon called udev. The udev daemon reads a set of rules (located in /etc/udev/rules.d/) to determine what the device is, what it should be named, and what permissions it should have.
Once udev processes the event, it automatically creates (or removes) the corresponding device node in /dev. You can observe this behavior by monitoring the kernel’s message buffer while plugging in a device:
# Watch the kernel messages as you plug in a device
dmesg -w
When you insert a USB drive, you will see the kernel announce that a new storage device has been detected. Simultaneously, if you check /dev before and after, you will see a new entry (like /dev/sdb) materialize instantly. When you safely remove the device, udev ensures that the node is deleted to prevent software from trying to access hardware that is no longer physically present. This automation ensures that your filesystem remains a clean, accurate reflection of the hardware currently attached to your machine.
Key Takeaway: The Linux kernel detects hardware changes and works with the udev daemon to automatically create and remove device nodes in /dev, ensuring the filesystem always reflects the current state of your system hardware.