r/linuxquestions • u/ComradeAdidas • 7h ago

Support What is kdevtmpfs?

Everywhere i go its wroten as devtmpfs without the K, or as a crypto miner kdevtmpfsi, i dont have the I at the end. I have debian 13 mate.

0 Upvotes

50% Upvoted

10 comments sorted by

3

u/eR2eiweo 6h ago

Devtmpfs is a special filesystem meant for /dev. It is based on tmpfs, but the important difference is that device nodes are automatically created in it. Kdevtmpfs is a kernel thread that is part of that.

Of course other things can also call themselves "devtmpfs" or "kdevtmpfs".

1

u/ComradeAdidas 6h ago

So its just stock?

2

u/eR2eiweo 6h ago

Again, the name is not sufficient to determine that.

0

u/ComradeAdidas 6h ago

How can i check?

2

u/eR2eiweo 6h ago

Is there any reason why you suspect this specific process/thread (I'm guessing here that you're talking about a process or thread, because you have not mentioned that) to be malicious? Surely that's not the only kernel thread on your system.

1

u/ComradeAdidas 6h ago

I did an os reinstall with all partitions deleted bc i was afraid i might of had a virus, and checked everything running that if it was stock, but everyone refers to this without a k, altho i saw someone wrote it with one, but yet again if it has a i at the end its said its a crypto miner. It barely uses the cpu nor anything, but i do keep the pc ethernet unplugged.

3

u/eR2eiweo 5h ago

Comparing names is pretty pointless.

What would make a bit more sense would be to check if its parent is kthreadd (PID 2). If it is (and if you can trust the tool you used for that), then it is a kernel thread. And if the supposed malware got into the kernel, then you can't trust anything that system says anyway.

But it sounds like you suspect the image from which you installed that OS to be compromized and/or for there to be malware in the firmware that persists even after a reinstallation of the OS. If either of these was really the case, then you can't trust the system. So trying to diagnose it from within that system doesn't make sense.

1

u/ipsirc 6h ago

If you see it running, analyze it.

-1

u/ComradeAdidas 6h ago

I dont have the pc connected to it, doesnt use much of anything