Audit uses of the umount2 system call

Description

Successful and unsuccessful uses of the umount2 system call must generate an audit record to detect unauthorized filesystem unmounting.

Rationale

The umount2 syscall is a variant of umount used for forceful or lazy unmounting. Auditing it ensures comprehensive coverage of unmount operations that could indicate an attacker removing security controls or log partitions.

Framework references

Live verification