Hi Jakub, On Mon, Dec 3, 2012 at 3:58 PM, Jakub Bednar <jakub.bednar@avg.com> wrote:

I am writing a KAUTH subsystem module and I am wondering how can I detect file system unmount. I thought that checking for KAUTH_VNODE_DELETE | KAUTH_VNODE_DELETE_CHILD and vnode_mountedon(), will tell me, when an unmount is about to happen. But unfortunately it does not work this way.

For some reason the KAUTH_VNODE_DELETE is getting called even for mount points that are not being unmounted. I tried also checking vfs_isunmount(vnode_mount()), but it returns false all the time.

Any help would be most appreciated.

I'm unaware of any in-kernel mechanism which tells you about a successful unmount, but depending on what you're trying to do, the mpo_mount_check_umount callback in the Mandatory Access Control (MAC) Framework[1] might be enough. It gets called before an unmount, and any listeners registered for it can stop the unmount from happening. So at that point the file system is still mounted, and the unmount might not happen. I haven't found any public kernel APIs that notify you of a successful unmount. Hope that helps, phil [1] http://developer.apple.com/library/Mac/#documentation/Kernel/Reference/mac_p... -- http://philjordan.eu/ - Phil Jordan, software development contractor _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel@lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.... This email sent to site_archiver@lists.apple.com