sysfs, udev and dbus

TL;DR

sysfs exposes -> udev acts -> dbus notifies

Relationship between sysfs, udev and dbus

sysfs: when the kernel detects a device, it creates a tree of directories and files there representing objects (buses, devices, drivers) and their attributes.

udev: it is the daemon that reacts to kernel events. When hardware appears or disappears, the kernel sends a uevent (a notification message). udev catches it, then goes to /sys to read everything about the new device — vendor ID, device type, capabilities. It then applies rules from /etc/udev/rules.d and creates or removes the appropriate device node in /dev.

dbus: udev publish messages onto dbus when things happen. Userspace applications like NetworkManager or a desktop file manager subscribe and react.

So when you plug in a USB stick: the kernel populates new entries in sysfs and creates the uevent. udev sees the uevent and creates /dev/sdb, emits a dbus signal, and your file manager pops up an automount dialog.