{
    "mode": "man",
    "parameter": "UDEV",
    "section": "7",
    "url": "https://www.chedong.com/phpMan.php/man/UDEV/7/json",
    "generated": "2026-05-30T06:05:24Z",
    "sections": {
        "NAME": {
            "content": "udev - Dynamic device management\n",
            "subsections": []
        },
        "DESCRIPTION": {
            "content": "udev supplies the system software with device events, manages permissions of device nodes and\nmay create additional symlinks in the /dev/ directory, or renames network interfaces. The\nkernel usually just assigns unpredictable device names based on the order of discovery.\nMeaningful symlinks or network device names provide a way to reliably identify devices based\non their properties or current configuration.\n\nThe udev daemon, systemd-udevd.service(8), receives device uevents directly from the kernel\nwhenever a device is added or removed from the system, or it changes its state. When udev\nreceives a device event, it matches its configured set of rules against various device\nattributes to identify the device. Rules that match may provide additional device information\nto be stored in the udev database or to be used to create meaningful symlink names.\n\nAll device information udev processes is stored in the udev database and sent out to possible\nevent subscribers. Access to all stored data and the event sources is provided by the library\nlibudev.\n",
            "subsections": []
        },
        "RULES FILES": {
            "content": "The udev rules are read from the files located in the system rules directories\n/lib/udev/rules.d and /usr/local/lib/udev/rules.d, the volatile runtime directory\n/run/udev/rules.d and the local administration directory /etc/udev/rules.d. All rules files\nare collectively sorted and processed in lexical order, regardless of the directories in\nwhich they live. However, files with identical filenames replace each other. Files in /etc/\nhave the highest priority, files in /run/ take precedence over files with the same name under\n/usr/. This can be used to override a system-supplied rules file with a local file if needed;\na symlink in /etc/ with the same name as a rules file in /lib/, pointing to /dev/null,\ndisables the rules file entirely. Rule files must have the extension .rules; other extensions\nare ignored.\n\nEvery line in the rules file contains at least one key-value pair. Except for empty lines or\nlines beginning with \"#\", which are ignored. There are two kinds of keys: match and\nassignment. If all match keys match against their values, the rule gets applied and the\nassignment keys get the specified values assigned.\n\nA matching rule may rename a network interface, add symlinks pointing to the device node, or\nrun a specified program as part of the event handling.\n\nA rule consists of a comma-separated list of one or more key-operator-value expressions. Each\nexpression has a distinct effect, depending on the key and operator used.\n",
            "subsections": [
                {
                    "name": "Operators",
                    "content": "\"==\"\nCompare for equality. (The specified key has the specified value.)\n\n\"!=\"\nCompare for inequality. (The specified key doesn't have the specified value, or the\nspecified key is not present at all.)\n\n\"=\"\nAssign a value to a key. Keys that represent a list are reset and only this single value\nis assigned.\n\n\"+=\"\nAdd the value to a key that holds a list of entries.\n\n\"-=\"\nRemove the value from a key that holds a list of entries.\n\n\":=\"\nAssign a value to a key finally; disallow any later changes.\n"
                },
                {
                    "name": "Values",
                    "content": "Values are written as double quoted strings, such as (\"string\"). To include a quotation mark\n(\") in the value, precede it by a backslash (\\\"). Any other occurrences of a backslash\nfollowed by a character are not unescaped. That is, \"\\t\\n\" is treated as four characters:\nbackslash, lowercase t, backslash, lowercase n.\n\nThe string can be prefixed with a lowercase e (e\"string\\n\") to mark the string as C-style\nescaped[1]. For example, e\"string\\n\" is parsed as 7 characters: 6 lowercase letters and a\nnewline. This can be useful for writing special characters when a kernel driver requires\nthem.\n\nPlease note that NUL is not allowed in either string variant.\n"
                },
                {
                    "name": "Keys",
                    "content": "The following key names can be used to match against device properties. Some of the keys also\nmatch against properties of the parent devices in sysfs, not only the device that has\ngenerated the event. If multiple keys that match a parent device are specified in a single\nrule, all these keys must match at one and the same parent device.\n\nACTION\nMatch the name of the event action.\n\nDEVPATH\nMatch the devpath of the event device.\n\nKERNEL\nMatch the name of the event device.\n\nKERNELS\nSearch the devpath upwards for a matching device name.\n\nNAME\nMatch the name of a network interface. It can be used once the NAME key has been set in\none of the preceding rules.\n\nSYMLINK\nMatch the name of a symlink targeting the node. It can be used once a SYMLINK key has\nbeen set in one of the preceding rules. There may be multiple symlinks; only one needs to\nmatch.\n\nSUBSYSTEM\nMatch the subsystem of the event device.\n\nSUBSYSTEMS\nSearch the devpath upwards for a matching device subsystem name.\n\nDRIVER\nMatch the driver name of the event device. Only set this key for devices which are bound\nto a driver at the time the event is generated.\n\nDRIVERS\nSearch the devpath upwards for a matching device driver name.\n\nATTR{filename}\nMatch sysfs attribute value of the event device.\n\nTrailing whitespace in the attribute values is ignored unless the specified match value\nitself contains trailing whitespace.\n\nATTRS{filename}\nSearch the devpath upwards for a device with matching sysfs attribute values. If multiple\nATTRS matches are specified, all of them must match on the same device.\n\nTrailing whitespace in the attribute values is ignored unless the specified match value\nitself contains trailing whitespace.\n\nSYSCTL{kernel parameter}\nMatch a kernel parameter value.\n\nENV{key}\nMatch against a device property value.\n\nCONST{key}\nMatch against a system-wide constant. Supported keys are:\n\n\"arch\"\nSystem's architecture. See ConditionArchitecture= in systemd.unit(5) for possible\nvalues.\n\n\"virt\"\nSystem's virtualization environment. See systemd-detect-virt(1) for possible values.\n\nUnknown keys will never match.\n\nTAG\nMatch against a device tag.\n\nTAGS\nSearch the devpath upwards for a device with matching tag.\n\nTEST{octal mode mask}\nTest the existence of a file. An octal mode mask can be specified if needed.\n\nPROGRAM\nExecute a program to determine whether there is a match; the key is true if the program\nreturns successfully. The device properties are made available to the executed program in\nthe environment. The program's standard output is available in the RESULT key.\n\nThis can only be used for very short-running foreground tasks. For details, see RUN.\n\nNote that multiple PROGRAM keys may be specified in one rule, and \"=\", \":=\", and \"+=\"\nhave the same effect as \"==\".\n\nRESULT\nMatch the returned string of the last PROGRAM call. This key can be used in the same or\nin any later rule after a PROGRAM call.\n\nMost of the fields support shell glob pattern matching and alternate patterns. The following\nspecial characters are supported:\n\n\"*\"\nMatches zero or more characters.\n\n\"?\"\nMatches any single character.\n\n\"[]\"\nMatches any single character specified within the brackets. For example, the pattern\nstring \"tty[SR]\" would match either \"ttyS\" or \"ttyR\". Ranges are also supported via the\n\"-\" character. For example, to match on the range of all digits, the pattern \"[0-9]\"\ncould be used. If the first character following the \"[\" is a \"!\", any characters not\nenclosed are matched.\n\n\"|\"\nSeparates alternative patterns. For example, the pattern string \"abc|x*\" would match\neither \"abc\" or \"x*\".\n\nThe following keys can get values assigned:\n\nNAME\nThe name to use for a network interface. See systemd.link(5) for a higher-level mechanism\nfor setting the interface name. The name of a device node cannot be changed by udev, only\nadditional symlinks can be created.\n\nSYMLINK\nThe name of a symlink targeting the node. Every matching rule adds this value to the list\nof symlinks to be created.\n\nThe set of characters to name a symlink is limited. Allowed characters are\n\"0-9A-Za-z#+-.:=@/\", valid UTF-8 character sequences, and \"\\x00\" hex encoding. All other\ncharacters are replaced by a \"\" character.\n\nMultiple symlinks may be specified by separating the names by the space character. In\ncase multiple devices claim the same name, the link always points to the device with the\nhighest linkpriority. If the current device goes away, the links are re-evaluated and\nthe device with the next highest linkpriority becomes the owner of the link. If no\nlinkpriority is specified, the order of the devices (and which one of them owns the\nlink) is undefined.\n\nSymlink names must never conflict with the kernel's default device node names, as that\nwould result in unpredictable behavior.\n\nOWNER, GROUP, MODE\nThe permissions for the device node. Every specified value overrides the compiled-in\ndefault value.\n\nSECLABEL{module}\nApplies the specified Linux Security Module label to the device node.\n\nATTR{key}\nThe value that should be written to a sysfs attribute of the event device.\n\nSYSCTL{kernel parameter}\nThe value that should be written to kernel parameter.\n\nENV{key}\nSet a device property value. Property names with a leading \".\"  are neither stored in the\ndatabase nor exported to events or external tools (run by, for example, the PROGRAM match\nkey).\n\nTAG\nAttach a tag to a device. This is used to filter events for users of libudev's monitor\nfunctionality, or to enumerate a group of tagged devices. The implementation can only\nwork efficiently if only a few tags are attached to a device. It is only meant to be used\nin contexts with specific device filter requirements, and not as a general-purpose flag.\nExcessive use might result in inefficient event handling.\n\nRUN{type}\nSpecify a program to be executed after processing of all the rules for the event. With\n\"+=\", this invocation is added to the list, and with \"=\" or \":=\", it replaces any\nprevious contents of the list. Please note that both \"program\" and \"builtin\" types\ndescribed below share a common list, so clearing the list with \":=\" and \"=\" affects both\ntypes.\n\ntype may be:\n\n\"program\"\nExecute an external program specified as the assigned value. If no absolute path is\ngiven, the program is expected to live in /lib/udev; otherwise, the absolute path\nmust be specified.\n\nThis is the default if no type is specified.\n\n\"builtin\"\nAs program, but use one of the built-in programs rather than an external one.\n\nThe program name and following arguments are separated by spaces. Single quotes can be\nused to specify arguments with spaces.\n\nThis can only be used for very short-running foreground tasks. Running an event process\nfor a long period of time may block all further events for this or a dependent device.\n\nNote that running programs that access the network or mount/unmount filesystems is not\nallowed inside of udev rules, due to the default sandbox that is enforced on\nsystemd-udevd.service.\n\nStarting daemons or other long-running processes is not allowed; the forked processes,\ndetached or not, will be unconditionally killed after the event handling has finished. In\norder to activate long-running processes from udev rules, provide a service unit and pull\nit in from a udev device using the SYSTEMDWANTS device property. See systemd.device(5)\nfor details.\n\nLABEL\nA named label to which a GOTO may jump.\n\nGOTO\nJumps to the next LABEL with a matching name.\n\nIMPORT{type}\nImport a set of variables as device properties, depending on type:\n\n\"program\"\nExecute an external program specified as the assigned value and, if it returns\nsuccessfully, import its output, which must be in environment key format. Path\nspecification, command/argument separation, and quoting work like in RUN.\n\n\"builtin\"\nSimilar to \"program\", but use one of the built-in programs rather than an external\none.\n\n\"file\"\nImport a text file specified as the assigned value, the content of which must be in\nenvironment key format.\n\n\"db\"\nImport a single property specified as the assigned value from the current device\ndatabase. This works only if the database is already populated by an earlier event.\n\n\"cmdline\"\nImport a single property from the kernel command line. For simple flags the value of\nthe property is set to \"1\".\n\n\"parent\"\nImport the stored keys from the parent device by reading the database entry of the\nparent device. The value assigned to IMPORT{parent} is used as a filter of key names\nto import (with the same shell glob pattern matching used for comparisons).\n\nThis can only be used for very short-running foreground tasks. For details see RUN.\n\nNote that multiple IMPORT{} keys may be specified in one rule, and \"=\", \":=\", and \"+=\"\nhave the same effect as \"==\". The key is true if the import is successful, unless \"!=\" is\nused as the operator which causes the key to be true if the import failed.\n\nOPTIONS\nRule and device options:\n\nlinkpriority=value\nSpecify the priority of the created symlinks. Devices with higher priorities\noverwrite existing symlinks of other devices. The default is 0.\n\nstringescape=none|replace\nWhen \"replace\", possibly unsafe characters in strings assigned to NAME, SYMLINK, and\nENV{key} are replaced. When \"none\", no replacement is performed. When unset, the\nreplacement is performed for NAME, SYMLINK, but not for ENV{key}. Defaults to unset.\n\nstaticnode=\nApply the permissions specified in this rule to the static device node with the\nspecified name. Also, for every tag specified in this rule, create a symlink in the\ndirectory /run/udev/staticnode-tags/tag pointing at the static device node with the\nspecified name. Static device node creation is performed by systemd-tmpfiles before\nsystemd-udevd is started. The static nodes might not have a corresponding kernel\ndevice; they are used to trigger automatic kernel module loading when they are\naccessed.\n\nwatch\nWatch the device node with inotify; when the node is closed after being opened for\nwriting, a change uevent is synthesized.\n\nnowatch\nDisable the watching of a device node with inotify.\n\ndbpersist\nSet the flag (sticky bit) on the udev database entry of the event device. Device\nproperties are then kept in the database even when udevadm info --cleanup-db is\ncalled. This option can be useful in certain cases (e.g. Device Mapper devices) for\npersisting device state on the transition from initramfs.\n\nloglevel=level\nTakes a log level name like \"debug\" or \"info\", or a special value \"reset\". When a log\nlevel name is specified, the maximum log level is changed to that level. When \"reset\"\nis set, then the previously specified log level is revoked. Defaults to the log level\nof the main process of systemd-udevd.\n\nThis may be useful when debugging events for certain devices. Note that the log level\nis applied when the line including this rule is processed. So, for debugging, it is\nrecommended that this is specified at earlier place, e.g., the first line of\n00-debug.rules.\n\nExample for debugging uevent processing for network interfaces.\n\n# /etc/udev/rules.d/00-debug-net.rules\nSUBSYSTEM==\"net\", OPTIONS=\"loglevel=debug\"\n\nThe NAME, SYMLINK, PROGRAM, OWNER, GROUP, MODE, SECLABEL, and RUN fields support simple\nstring substitutions. The RUN substitutions are performed after all rules have been\nprocessed, right before the program is executed, allowing for the use of device properties\nset by earlier matching rules. For all other fields, substitutions are performed while the\nindividual rule is being processed. The available substitutions are:\n\n$kernel, %k\nThe kernel name for this device.\n\n$number, %n\nThe kernel number for this device. For example, \"sda3\" has kernel number 3.\n\n$devpath, %p\nThe devpath of the device.\n\n$id, %b\nThe name of the device matched while searching the devpath upwards for SUBSYSTEMS,\nKERNELS, DRIVERS, and ATTRS.\n"
                },
                {
                    "name": "$driver",
                    "content": "The driver name of the device matched while searching the devpath upwards for SUBSYSTEMS,\nKERNELS, DRIVERS, and ATTRS.\n\n$attr{file}, %s{file}\nThe value of a sysfs attribute found at the device where all keys of the rule have\nmatched. If the matching device does not have such an attribute, and a previous KERNELS,\nSUBSYSTEMS, DRIVERS, or ATTRS test selected a parent device, then the attribute from that\nparent device is used.\n\nIf the attribute is a symlink, the last element of the symlink target is returned as the\nvalue.\n\n$env{key}, %E{key}\nA device property value.\n\n$major, %M\nThe kernel major number for the device.\n\n$minor, %m\nThe kernel minor number for the device.\n\n$result, %c\nThe string returned by the external program requested with PROGRAM. A single part of the\nstring, separated by a space character, may be selected by specifying the part number as\nan attribute: \"%c{N}\". If the number is followed by the \"+\" character, this part plus all\nremaining parts of the result string are substituted: \"%c{N+}\".\n\n$parent, %P\nThe node name of the parent device.\n"
                },
                {
                    "name": "$name",
                    "content": "The current name of the device. If not changed by a rule, it is the name of the kernel\ndevice.\n"
                },
                {
                    "name": "$links",
                    "content": "A space-separated list of the current symlinks. The value is only set during a remove\nevent or if an earlier rule assigned a value.\n\n$root, %r\nThe udevroot value.\n\n$sys, %S\nThe sysfs mount point.\n\n$devnode, %N\nThe name of the device node.\n\n%%\nThe \"%\" character itself.\n\n$$\nThe \"$\" character itself.\n"
                }
            ]
        },
        "SEE ALSO": {
            "content": "systemd-udevd.service(8), udevadm(8), systemd.link(5)\n",
            "subsections": []
        },
        "NOTES": {
            "content": "1. C-style escaped\nhttps://en.wikipedia.org/wiki/EscapesequencesinC#Tableofescapesequences\n\n\n\nsystemd 249                                                                                  UDEV(7)",
            "subsections": []
        }
    },
    "summary": "udev - Dynamic device management",
    "flags": [],
    "examples": [],
    "see_also": [
        {
            "name": "systemd-udevd.service",
            "section": "8",
            "url": "https://www.chedong.com/phpMan.php/man/systemd-udevd.service/8/json"
        },
        {
            "name": "udevadm",
            "section": "8",
            "url": "https://www.chedong.com/phpMan.php/man/udevadm/8/json"
        },
        {
            "name": "systemd.link",
            "section": "5",
            "url": "https://www.chedong.com/phpMan.php/man/systemd.link/5/json"
        }
    ]
}