sysfs
Generated by GPT-5-miniExpansion Funnel Raw 50 → Dedup 0 → NER 0 → Enqueued 0
| sysfs | |
|---|---|
| Name | sysfs |
| Introduced | 2002 |
| Developer | Linux community |
| Operating system | Linux |
| License | GPL |
| Website | Linux kernel documentation |
sysfs sysfs is a virtual filesystem in Linux that exposes kernel device, driver, and subsystem information to user space via a hierarchical file-like interface. It complements procfs and devfs by representing objects in the kernel's device model and enabling configuration and introspection by tools and administrators. sysfs is widely used by udev, systemd, and hardware management utilities to enumerate devices, read attributes, and trigger actions.
Overview
sysfs provides a tree of directories and attributes reflecting kernel objects such as devices, buses, drivers, and kernel subsystems. Common consumers include udev, systemd, HAL (historical), and graphical managers like GNOME and KDE. It interacts with kernel mechanisms like kobject and kset to present names and attributes that map to kernel structures and functions. sysfs complements device node management done by devtmpfs and the device mapper infrastructure.
History and development
Work on sysfs began as part of efforts to unify device representation in the early 2000s led by kernel developers in the Linux community. Key figures in the subsystem's creation include developers associated with Kernel Summit discussions and patches submitted to Linus Torvalds' tree. sysfs evolved alongside kernel device model changes and integration with udev, with milestones documented in kernel mailing lists such as Linux Kernel Mailing List. The adoption of sysfs influenced projects like udev and systemd and paralleled the decline of legacy approaches like devfs.
Design and architecture
sysfs is implemented as an in-memory virtual filesystem mounted typically at /sys and backed by kernel objects representing devices, drivers, and subsystems. It relies on the kernel's kobject infrastructure and uses kset and kobj_type to manage lifetime, reference counting, and attribute groups. The design emphasizes a one-to-one mapping between kernel objects and sysfs entries and integrates with kernel concepts such as device model, driver model, and bus abstractions. sysfs entries are created and removed by kernel code in response to hotplug events handled through mechanisms like uevent.
Interface and file types
sysfs exposes attributes as text files where reading and writing correspond to getter and setter callbacks in kernel code. Standard file types include attribute files, link entries that reflect relationships (for example between devices and controllers), and directories that represent object hierarchies. Common patterns used by kernel subsystems include "enable", "status", "modalias", and "uevent" attributes consumed by tools such as modprobe, insmod, and udevadm. sysfs also hosts specialized interfaces for power management used by ACPI integrations and for topology information leveraged by NUMA aware components.
Kernel integration and exports
Kernel subsystems export state and control through sysfs by registering kobjects and attribute groups from modules and built-in drivers. Examples of kernel components exposing sysfs entries include SATA, PCI Express, USB stacks, and networking drivers. Modules may create entries during init and remove them on exit; helpers such as sysfs_create_group and device_create_file simplify this. The exported attributes facilitate actions like binding/unbinding drivers, changing runtime power management settings, and exposing statistics used by perf and other performance tools.
User-space interaction and tools
Administrators and programs interact with sysfs using standard filesystem operations; tools automate these interactions. udev uses sysfs to discover devices and trigger rules for populating /dev, while systemd reads sysfs for device and mount point discovery. Utilities such as udevadm, lsmod, lspci, lsusb, and hwinfo read sysfs to present hardware details. Scripting languages and configuration management tools like Ansible, Puppet, and Chef may query sysfs paths to make provisioning decisions. Debugging and development often leverage kernel build and test infrastructures coordinated via KernelCI and continuous integration services.
Security and permissions
sysfs permissions and ownership are controlled by the kernel and udev rules; files typically have owner and mode settings that limit access to privileged users and groups like root. Careful assignment of permissions is required because writable attributes can affect kernel behavior, including module loading and device configuration, which relates to CVE disclosures and vulnerability management practices coordinated by Common Vulnerabilities and Exposures. Administrators should apply principle of least privilege and use kernel security modules such as SELinux, AppArmor, or smack to constrain access. Auditing tools like auditd can monitor sysfs operations for security incidents.