On macOS, ChmodBPF adds new BPF devices at boot only

Question

The script ChmodBPF creates new /dev/bpf interfaces and set specific permissions thanks to the code:

while [ "$CUR_DEV" -lt "$FORCE_CREATE_BPF_MAX" ] ; do
    # Try to do the minimum necessary to trigger the next device.
    read -n 0 < /dev/bpf$CUR_DEV > /dev/null 2>&1
    CUR_DEV=$(( $CUR_DEV + 1 ))
done

I've deleted /dev/bpf250, and launched ChmodBPF as root, but "read -n 0 < /dev/bpf249" doesn't create /dev/bpf250.

I rebooted macOS, and this time the script created /dev/bpf250.

What prevents the manual execution of ChmodBPF as root to create new BPF devices?

Answer 1

I've deleted /dev/bpf250, and launched ChmodBPF as root, "read -n 0 < /dev/bpf249" doesn't create /dev/bpf250

The relevant code only creates a BPF device if the device number is greater than the maximum device number ever created; it doesn't fill in artificially-created holes in the BPF device number space.

(What Apple should do is implement a cloning BPF device, so that you can just open /dev/bpf and get a new BPF device; they'd still have to leave the old numbered devices, complete with the existing creation operation, for backwards compatibility, but they could and should then enable libpcap's support for the cloning device. Darwin does support cloning devices.)