Skip to content

umount

Intro

umount - Unmount file systems on linux

Description

The umount function is used to unmount a given file system from the specified target on linux. This is done by issuing a request to the virtual file system to detach the file system as well as any associated mount points. Umount can also be used to unmount all mount points in a given target. Note that unmounting a filesystem removes the filesystem from both user and kernel spaces, so it is important to first ensure that nothing in user space is actively using the filesystem.

There are some edge cases to consider when using umount. For example, the "lazy unmount" option can be used to prevent processes from being impacted by an unmount event by keeping them alive until the next time they try to access the filesystem. However, if the filesystem is mounted with a read-only flag, the lazy unmount will not be applied as the processes should be able to keep running despite the filesystem being unmounted.

Arguments

  • target:const char* - Pathname of the block special device or directory to be unmounted.

Available Tags

  • U - Originated from user space (for example, pointer to user space memory used to get it)

Hooks

sys_umount

Type

Kprobe + Kretprobe

Purpose

Hooking the sys_umount function is used to gather information about filesystem usage by monitoring both the entry and exit of any umount call.

Example Use Case

One common use case might be monitoring the usage of a given filesystem. When an unmount is requested, this event would be triggered with the corresponding arguments. Analysing this data could be helpful to track usage patterns, or troubleshoot issues with the unmount operation.

Issues

If umount is issued with no target specified, it will try to unmount all mount points, which could have unintended effects on the system. It may be a good idea to have monitoring systems in place to detect in case it is used in this manner.

  • mount

This document was automatically generated by OpenAI and needs review. It might not be accurate and might contain errors. The authors of Tracee recommend that the user reads the "events.go" source file to understand the events and their arguments better.