Monitor the use of the mount system call. The mount (and umount) system call controls the mounting and unmounting of file systems. The parameters below configure the system to create an audit record when the mount system call is used by a non-privileged user.
It is highly unusual for a non privileged user to mount file systems to the system. While tracking mount commands gives the system administ ...