Audit uses of the umount system call

Description

Successful and unsuccessful uses of the umount system call must generate an audit record to detect unauthorized filesystem unmounting.

Rationale

Auditing umount syscalls detects attempts to remove filesystems that may be part of an attack, such as unmounting security monitoring partitions or audit log partitions.

Framework references

Live verification