8.1 Mounting and Unmounting Filesystems: mount & umount (104.3)

8.1 Mounting and Unmounting Filesystems: mount & umount

Quick Summary: Linux unifies all physical storage devices, network shares, and pseudo-filesystems into a single hierarchical directory tree rooted at /. The mount command attaches a formatted filesystem on a block device or image file to an existing directory known as a mount point. The umount command safely flushes pending writes from memory buffers to disk and detaches the filesystem. Understanding mount syntax, security flags (nosuid, noexec, nodev), non-root user mounting rules (user vs. users), dynamic remounting, bind mounts, and busy mount diagnostics (fuser, lsof) is essential for Topic 104.3 of the LPIC-1 exam.

---

1. The Linux Unified Directory Hierarchy & VFS Architecture

Unlike operating systems that assign distinct drive letters (such as C:, D:, or E:) to different storage devices, Linux uses a single, unbroken Virtual Filesystem (VFS) tree. Every storage partition, optical disc, USB flash drive, network export, and virtual memory filesystem attaches to a specific directory within this tree.

Unified Linux VFS Mount Hierarchy:
                 /
                 ├── bin
                 ├── boot  ──────────> Mounted from /dev/sda1 (ext4)
                 ├── etc
                 ├── home  ──────────> Mounted from /dev/sdb1 (xfs)
                 │    └── user1
                 ├── mnt   ──────────> Temporary manual mounts (e.g. /dev/sdc1)
                 ├── media ──────────> Removable media (e.g. USB / optical)
                 │    └── usb
                 └── var   ──────────> Mounted from /dev/sda3 (ext4)

The Mount Point Concept

A mount point is simply an existing directory on the host filesystem where another filesystem is attached. When a filesystem is mounted on a directory:

1. Any existing files previously inside that directory become temporarily invisible and inaccessible (they are masked by the root of the mounted filesystem).
2. The files remain intact on the underlying storage layer and reappear automatically when the filesystem is unmounted.
3. Best practice dictates that mount point directories should be empty prior to mounting.

---

2. The mount Command: Syntax & General Flags

The mount command serves two distinct purposes:

• When invoked without arguments, it displays a listing of all currently mounted filesystems, their mount points, filesystem types, and active options (read from /proc/mounts or /etc/mtab).
• When invoked with arguments, it instructs the kernel to mount a specified storage device or resource onto a target directory.

# General mount command syntax:
mount [options] [-t fstype] [-o options] <device|source> <mountpoint>

General mount Command-Line Options

# Example 1: Mount an ext4 partition to /mnt/data
$ sudo mount -t ext4 /dev/sdb1 /mnt/data

# Example 2: Mount a FAT32 USB drive in read-only verbose mode
$ sudo mount -v -t vfat -r /dev/sdc1 /media/usb
mount: /dev/sdc1 mounted on /media/usb (type vfat, read-only).

# Example 3: Mount all filesystems defined in /etc/fstab
$ sudo mount -a

---

3. Filesystem-Independent Mount Options (-o)

The -o flag accepts a comma-separated list of options without any spaces. These options govern operational behavior, write caching policies, access timestamps, and security constraints.

Essential Mount Options Reference

⚠️ LPIC-1 Trap — The Security Implications of user: When an administrator places the user option in /etc/fstab, the kernel enforces strict defensive defaults: it automatically applies noexec, nosuid, and nodev. If an unprivileged user needs to execute binaries from that mount, /etc/fstab must list user,exec in that specific order. If written as exec,user, the trailing user option will overwrite exec with noexec!

---

4. Special Mounting Techniques: Remount, Loop & Bind

1. Dynamic Remounting (remount)

During single-user maintenance mode, rescue boots, or storage failover, the root filesystem / often mounts initially in read-only mode (ro). Administrators switch the live filesystem to read-write without rebooting using remount:

# Remount the root filesystem in read-write mode:
$ sudo mount -o remount,rw /

# Switch a data partition to read-only for safe maintenance:
$ sudo mount -o remount,ro /srv/data

2. Loopback Image Mounting (loop)

A disk image file or optical ISO is a regular file on disk containing a raw filesystem layout. The loop option associates the image file with a virtual loop block device (/dev/loopX), allowing it to be mounted like physical media:

# Mount a Linux distribution ISO image to /mnt/iso:
$ sudo mount -o loop,ro ubuntu-24.04-live-server-amd64.iso /mnt/iso

# In modern Linux kernels with util-linux, loop is detected automatically:
$ sudo mount -t iso9660 -o ro debian-12.0.iso /mnt/iso

3. Bind Mounts (--bind)

A bind mount makes an existing directory structure visible at a second location in the VFS tree. Changes made in either directory are immediately reflected in both, as both paths point to the identical underlying inodes:

# Mirror /var/www/html into an FTP jail directory:
$ sudo mount --bind /var/www/html /srv/ftp/web

# Equivalent syntax using -o bind:
$ sudo mount -o bind /var/www/html /srv/ftp/web

---

5. Unmounting Filesystems with umount

The umount utility safely detaches a mounted filesystem from the VFS hierarchy. It flushes any unwritten file data stored in kernel page cache buffers to physical disk and marks the filesystem clean in the superblock.

# Unmount syntax accepts either the device node OR the mount point directory:
$ sudo umount /dev/sdb1
$ sudo umount /mnt/data

Essential umount Command Flags

⚠️ LPIC-1 Trap — Target is Busy Error: If an administrator or running process is currently inside the mount point directory (e.g., your current working directory is /mnt/data), executing umount /mnt/data will fail with umount: /mnt/data: target is busy. You must first change directory (cd / or cd ~) out of the mount point before unmounting.

---

6. Troubleshooting Busy Mount Points: fuser and lsof

When a filesystem cannot be unmounted because it is held open by background services, user sessions, or open file handles, administrators use fuser or lsof to locate and terminate the offending processes.

1. The fuser Utility

The fuser (file user) tool identifies PIDs of processes using specified files, directories, or mounted filesystems.

# Identify all processes using the /mnt/data mount point (-m / --mount):
$ sudo fuser -m -v /mnt/data
                     USER        PID ACCESS COMMAND
/mnt/data:           admin      3412 ..c..  bash
                     nginx      4105 .rc..  nginx

# Kill all processes holding open files on the mount point (-k / --kill):
$ sudo fuser -k -m /mnt/data
/mnt/data:           3412c  4105c

# Send a specific signal (SIGKILL / -9) to all processes on the mount:
$ sudo fuser -k -9 -m /mnt/data

fuser Access Codes:

• c: Current directory (process working directory is on the mount).
• e: Executable being run from the mount.
• f: Open file handle for reading or writing.
• r: Root directory of the process (chroot).
• m: Mapped file or shared library.

2. The lsof Utility

The lsof (list open files) utility lists all open files and the processes that opened them:

# Recursively list all open files located under the directory (+D):
$ sudo lsof +D /mnt/data
COMMAND  PID  USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
bash    3412 admin  cwd    DIR    8,17     4096    2 /mnt/data
nginx   4105 nginx    3r   REG    8,17   1048576   14 /mnt/data/log/access.log

💡 LPIC-1 Exam Fill-in-the-Blank Alert: What fuser command option specifies that the named directory argument is a mount point, causing fuser to report all processes accessing any file within that entire mounted filesystem? Answer: -m (or --mount)