8

So I know /dev contains all the drivers required for mouse , keyboard etc but can some dangerous malware delete the folder? Or can someone manually delete the folder with sudo?

1 Answers1

8

The directory that SIP (About System Integrity Protection) covers are

  • /System
  • /usr
  • /bin
  • /sbin
  • Apps that are pre-installed with OS X


/dev contains all the drivers required for mouse , keyboard etc

No. These are device nodes or special files that access the hardware directly.

Device drivers are usually located in the System Library as kexts (Kernel Extensions). See this answer for more further details.

can someone manually delete the folder with sudo?

Yes, you can delete this folder however, it should be restored upon reboot because these nodes are dynamically generated as hardware is detected. Under Linux and BSD, the command makedev will regenerate your devices. mknod will do the same for macOS.

From the man page (man mknod)

The mknod command creates device special files.

So, can malware delete or affect these files? Possibly, but it would be counterproductive because it would need root access to begin with and whatever changes would be temporary at best.

Allan
  • 101,432
  • 2
    SIP does prevent block-level writes to protected disks (e.g. writes to startup drive /dev/disk and /dev/rdisk devices), otherwise you could easily bypass restrictions. See https://apple.stackexchange.com/questions/193368/what-is-the-rootless-feature-in-el-capitan-really – user71659 Nov 04 '17 at 18:19
  • 1
    "Under Linux and BSD, the command makedev will regenerate your devices. mknod will do the same for macOS." – Actually, on almost all modern Linux distributions, /dev is dynamically managed by udev. Static makedev (or MAKEDEV) scripts haven't existed for over a decade. (Before udev, /dev was sometimes a virtual filesystem called devfs.) Also note that both the udevd daemon as well as the venerable old MAKEDEV scripts, simply call the mknod utility, and the devfs filesystem driver calls the mknod syscall. – Jörg W Mittag Nov 05 '17 at 04:24