How to determine in bash if / mountpoint was mounted from other OS?

Question

Im writing shell script to check if user may be doing some nasty things in Linux enviroment. One check i would like to do is determine if / filesyste was mounted using external OS (like using live SO) in previous mount.

First i think to exec script when boot to get the mount time in previous boot using journalctl and actual last mount using tune2fs, to compare it. But last mount using tune2fs gets current mount, not previous, because system is mounted when ckecks it.

Any idea to solve it? Thanks!

Answer 1

dmesg 's output shows about the mounting of / (and other infos as well). If your current OS's dmesg 's output has that info, it was mounted by the current system.

You can use the output of dmesg in your script like :

#!/bin/bash
number=$(dmesg | grep -c "sdaN")
if [ $number == 0 ]; then
    echo "It was not mounted by the current system"
else
    echo "It was mounted by the current system"
fi