Re: Preventing writes to the underlying directory when a mounted filesystem disappears

On Mon, 27 Jul 2026 11:06:13 -0300
Marcelo Laia <[email protected]> wrote:

> Hi Andy,
> 
> Thank you for your comments.
> 
> I completely agree that USB storage is not the most reliable solution,
> and if this were a conventional server I would probably choose a
> different architecture.

If you are using a small computer booting from a card or similar, most
will allow the use of a conventional hard drive/SSD as the root
filesystem. It just complicates the boot a little.
> 
> The motivation here is a little different. I'm trying to understand
> how Linux behaves when the target filesystem unexpectedly disappears
> and how to prevent applications from silently falling back to the
> underlying filesystem.

That's exactly what a mount point does. The directory must exist, and
it must continue to exist when nothing is mounted on it. I don't
believe there are any hooks to allow running a checking script before
writing to a log, and if there were the logging would be considerably
slowed down.

A mount directory will normally be created by root, and will typically
have root ownership and read-only permissions for anyone else, so only
if the logging daemon is running as root (one would hope it isn't)
should it be able to write there with nothing mounted.
> 
> The USB SSD is simply a convenient and inexpensive way to reproduce
> that failure mode. The same question could arise with removable SATA
> devices, SD cards, or other storage that may become unavailable
> unexpectedly.

You might also give some thought to mounting such a device, as it will
need to be mounted by device UUID in order to know where it will end
up. Current Debian unstable will mount a randomly plugged-in USB at
/run/media/<your name>/UUID-of-device. Older Debians mount to /media
rather than /run/media.

As far as I know, the only way to mount such a device wherever you want
it is by giving it an entry in /etc/fstab, still using the UUID. If you
do this and use the systemd automounter, also mark it noauto or else if
it's not there, boot will hang. It will be automounted at first access.

But you can't just pick a random USB stick out of a box of them and get
it mounted where the logging daemon will find it.
> 
> Several people have suggested placing the log files inside a
> subdirectory that exists only on the mounted filesystem, which seems
> like a very elegant safeguard. I'm also interested in exploring
> whether systemd, udev, or the logging daemon itself offer additional
> mechanisms for handling these situations gracefully.
> 
>
Doubtful. They will usually log to somewhere in /var/log, either in the
root filesystem or on a separate partition permanently mounted on the
root /var/log. Nothing stops you from moving the logs elsewhere, but I
wouldn't expect the daemons to deal with a missing mounted destination.

If you want to offload logging (or the rest of /var, some of which
is written to frequently) you would be best using a dedicated drive
mounted at boot by /etc/fstab, and never disconnected.