Find out user who mounted a device in linux

Question

Is it possible to find out in linux which user mounted a certain device?

After trying google I didn't find much information about this. I need to keep track about who mounted the ISO file which is used to install my software, so later if any update is needed this information is available and I can provide the user with a hint of which userID had this rights in the past.

Answer 1

Is it possible to find out in linux which user mounted a certain device?

Not intrinsically, no.

You could consider reviewing logs to determine who used sudo mount -o loop ${PATH_TO_IMG}, but I would strongly advise against it:

• It's going to be very unreliable (what happens if they sudo, then mount as root?)
• Will require lots of cross-system support and checks - where do you look?
  • /var/log/auth.log
  • /var/log/security.log
  • journalctl
• Will require handling different argument ordering and approach to the mount:
  • mount ${PATH_TO_IMG} -o loop
  • losetup -f ${PATH_TO_IMG} then mount /dev/loop*
• ... and probably a plethora other things I've not thought of

---

I need to keep track about who mounted the ISO file which is used to install my software, so later if any update is needed this information is available and I can provide the user with a hint of which userID had this rights in the past.

It might be a better idea to just list out any users in the sudo / wheel group:

getent group sudo | cut -d: -f 4-

Or perhaps remember the value of ${SUDO_USER} / ${SUDO_UID} if it is set, and presuming that the user needs to be root to install your software.