Hook into linux mount/umount event

Solution 1:

If you are trying to do this for people invoking the /sbin/mount and /sbin/umount command, all you'd have to do is make a wrapper program for both and program what you want into these wrapper programs.

A wrapper program being replace the /sbin/mount with the wrapper program that calls the real /sbin/mount (renamed to something like /sbin/mount-real or /sbin/umount-real). To prevent anybody from calling the real program, use group permissions to restrict it and set the SGID bit on the wrapper programs.

If you are looking to fix the mount(2) library call, well that is an effort and probably difficult and probably not advisable as this could cause problems for internal systems processing especially during startup and shutdown.

Even with a wrapper program you'd probably have to thoroughly test it to avoid system interference and made appropriate adjustments.