statmount(2)

💖 statmount(2) — System Calls Manual 💖

okay bestie, buckle UP, because today we're learning about statmount — the syscall that's basically a glow-up for reading mount info. no cap, it's giving "I know exactly what's mounted and where" energy. 🏔️✨

---

✨ NAME ✨

statmount — get a mount status 🫶

📚 LIBRARY 📚

Standard C library (libc, -lc)

🎀 SYNOPSIS 🎀

#include <linux/mount.h>  /* Definition of STATMOUNT_* constants */
#include <unistd.h>

int syscall(SYS_statmount, struct mnt_id_req *req,
            struct statmount *smbuf, size_t bufsize,
            unsigned int flags);

#include <linux/mount.h>

struct mnt_id_req {
    __u32  size;        /* sizeof(struct mnt_id_req) */
    union {
        __u32  mnt_ns_fd;  /* fd of mnt_ns to query the mnt_id in */
        __u32  mnt_fd;     /* fd on the mount being queried */
    };
    __u64  mnt_id;      /* The mnt_id being queried */
    __u64  param;       /* ORed combination of the STATMOUNT_ constants */
    __u32  mnt_ns_id;   /* The id of mnt_ns to query the mnt_id in */
};

struct statmount {
    __u32  size;
    __u32  mnt_opts;
    __u64  mask;
    __u32  sb_dev_major;
    __u32  sb_dev_minor;
    __u64  sb_magic;
    __u32  sb_flags;
    __u32  fs_type;
    __u64  mnt_id;
    __u64  mnt_parent_id;
    __u32  mnt_id_old;
    __u32  mnt_parent_id_old;
    __u64  mnt_attr;
    __u64  mnt_propagation;
    __u64  mnt_peer_group;
    __u64  mnt_master;
    __u64  propagate_from;
    __u32  mnt_root;
    __u32  mnt_point;
    __u64  mnt_ns_id;
    __u32  fs_subtype;
    __u32  sb_source;
    __u32  opt_num;
    __u32  opt_array;
    __u32  opt_sec_num;
    __u32  opt_sec_array;
    __u32  mnt_uidmap_num;
    __u32  mnt_uidmap;
    __u32  mnt_gidmap_num;
    __u32  mnt_gidmap;
    __u64  supported_mask;
    char   str[];
};

📌 Note: glibc provides no wrapper for statmount(), so you're gonna have to go through syscall(2). yes, manually. it's fine. it's iconic. 💅

---

🌸 DESCRIPTION 🌸

So, to peek at a mount's status, the caller needs CAP_SYS_ADMIN in the user namespace. and if you're tryna reach a mount in a foreign mount namespace (the one you specify via req.mnt_ns_id or req.mnt_ns_fd), that foreign mount namespace should be a child of the current namespace. family tree rules, bestie. 🌳

This function returns info about a mount, dropping it into the buffer pointed to by smbuf. What you get back is a struct statmount that's of size bufsize, with the fields filled in like we describe below. and flags? it must either be 0 or STATMOUNT_BY_FD. no third option, fr fr.

🫧 (Note that reserved space and padding is omitted.)

🦋 The mnt_id_req structure 🦋

• req.size — the kernel uses this to figure out which struct mnt_id_req you're actually passing in, so it should always be set to sizeof(struct mnt_id_req). don't skip it, it's the vibe check. 😤
• req.mnt_ns_fd — you can get this from the PIDFD_GET_MNT_NAMESPACE ioctl(2) operation, or by opening a file descriptor to /proc/pid/ns/mnt. it's used to specify a foreign mount namespace in which to query req.mnt_id (since Linux 6.18). ✨
• req.mnt_fd — a file descriptor on a mount. if the STATMOUNT_BY_FD flag is specified and req.mnt_id and req.mnt_ns_id are zeroed, the function returns information about the mount that the file descriptor is on (since Linux 7.0). 👑

The fd can also be on a mount that has been lazily unmounted (peep umount2(2) with MNT_DETACH). In that case, STATMOUNT_MNT_POINT and STATMOUNT_MNT_NS_ID will be unset, since an unmounted mount is no longer a part of the filesystem. it's giving ghosted. 👻

• req.mnt_id — you can get this from either statx(2) using STATX_MNT_ID_UNIQUE, or from listmount(2). it's used as the identifier to query the status of the mount point you want. 🎯
• req.param — tells the kernel which fields you're interested in. it's an ORed combination of the following constants:

STATMOUNT_SB_BASIC         /* Want/got sb_* */
STATMOUNT_MNT_BASIC        /* Want/got mnt_* */
STATMOUNT_PROPAGATE_FROM   /* Want/got propagate_from */
STATMOUNT_MNT_ROOT         /* Want/got mnt_root  */
STATMOUNT_MNT_POINT        /* Want/got mnt_point */
STATMOUNT_FS_TYPE          /* Want/got fs_type */
STATMOUNT_MNT_NS_ID        /* Want/got mnt_ns_id */
STATMOUNT_MNT_OPTS         /* Want/got mnt_opts */
STATMOUNT_FS_SUBTYPE       /* Want/got fs_subtype */
STATMOUNT_SB_SOURCE        /* Want/got sb_source */
STATMOUNT_OPT_ARRAY        /* Want/got opt_{num,array} */
STATMOUNT_OPT_SEC_ARRAY    /* Want/got opt_sec_{num,array} */
STATMOUNT_MNT_UIDMAP       /* Want/got uidmap{_num,} */
STATMOUNT_MNT_GIDMAP       /* Want/got gidmap{_num,} */
STATMOUNT_SUPPORTED_MASK   /* Want/got supported mask flags */

Generally speaking, the kernel does not reject values in req.param other than the ones above. (for the exception, see EINVAL in errors.) Instead, it just tells you which values are supported by this kernel and filesystem via the statmount.mask field. So like… do NOT just set req.param to UINT_MAX (all bits set), because one or more of those bits might, in the future, be used to specify an extension to the buffer. that's a trap, bestie, do not fall in it. 🙈

• req.mnt_ns_id — you can get this from the NS_GET_MNTNS_ID ioctl(2) operation. it's used to specify a foreign mount namespace in which to query req.mnt_id (since Linux 6.11). 🌈

💜 The returned information 💜

The status info for the target mount comes back in the statmount structure pointed to by smbuf. The fields go a little something like this:

• smbuf.size — the size of the returned smbuf structure, including any of the strings fields that were filled. 📏
• smbuf.mnt_opts (since Linux 6.11) — the offset to the location in the smbuf.str buffer that contains a comma separated list of mount options, similiar to those in proc_pid_mountinfo(5). it's a null-terminated string. 🧾
• smbuf.mask — the ORed combination of STATMOUNT_* flags indicating which fields were filled in and are therefore valid. The kernel may return fields that weren't requested, and may fail to return fields that were requested, depending on what the backing file system and kernel supports. either way, req.param will not be equal to mask. keep that in mind, it's a whole thing. 😭
• smbuf.sb_dev_major
• smbuf.sb_dev_minor — the device that is mounted at this mount point. 💾
• smbuf.sb_magic — the file system specific super block magic. 🔮
• smbuf.sb_flags — the flags that are set on the super block, an ORed combination of SB_RDONLY, SB_SYNCHRONOUS, SB_DIRSYNC, SB_LAZYTIME. 🚩
• smbuf.fs_type — the offset to the location in the smbuf.str buffer that contains the string representation of the mounted file system. it's a null-terminated string. 🌟
• smbuf.mnt_id — the unique mount ID of the mount. 🆔
• smbuf.mnt_parent_id — the unique mount ID of the parent mount point of this mount. if this is the root mount point then smbuf.mnt_id == smbuf.parent_mount_id. 🧬
• smbuf.mnt_id_old — this corresponds to the mount ID that is exported by /proc/pid/mountinfo. 📜
• smbuf.mnt_parent_id_old — this corresponds to the parent mount ID that is exported by /proc/pid/mountinfo. 📜
• smbuf.mnt_attr — the MOUNT_ATTR_* flags set on this mount point. 🏷️
• smbuf.mnt_propagation — the mount propagation flags, which can be one of MS_SHARED, MS_SLAVE, MS_PRIVATE, MS_UNBINDABLE. 📡
• smbuf.mnt_peer_group — the ID of the shared peer group. 👯
• smbuf.mnt_master — the mount point receives its propagation from this mount ID. 👑
• smbuf.propagate_from — the ID from the namespace we propagated from. 🌀
• smbuf.mnt_root — the offset to the location in the smbuf.str buffer that contains the string representation of the mount relative to the root of the file system. it's a null-terminated string. 🌱
• smbuf.mnt_point — the offset to the location in the smbuf.str buffer that contains the string representation of the mount relative to the current root (ie if you are in a chroot). it's a null-terminated string. 📍
• smbuf.mnt_ns_id (since Linux 6.11) — the unique ID of the mount namespace the mount belongs to. 🌌
• smbuf.fs_subtype (since Linux 6.13) — the offset to the location in the smbuf.str buffer that contains the string representation of the file system subtype. this is particularly useful for disambiguating FUSE mounts. it's a null-terminated string. 🔍
• smbuf.sb_source (since Linux 6.13) — the offset to the location in the smbuf.str that contains the source of the mount. it's a null-terminated string. 🏁
• smbuf.opt_num (since Linux 6.13) — the number of filesystem options set on the mount. 🔢
• smbuf.opt_array (since Linux 6.13) — the offset to the location in the smbuf.str buffer that contains file system options separated by null bytes. they can be iterated over with the help of smbuf.opt_num. 🔁
• smbuf.opt_sec_num (since Linux 6.13) — the number of security options set on the mount. 🔐
• smbuf.opt_sec_array (since Linux 6.13) — the offset to the location in the smbuf.str buffer that contains security options separated by null bytes. they can be iterated over with the help of smbuf.opt_sec_num. 🔁
• smbuf.mnt_uidmap_num (since Linux 6.15) — the number of uid mappings applied on the mount. if smbuf.mask has STATMOUNT_MNT_UIDMAP set and this field is 0, then uid mappings applied on the mount cannot be resolved in the user namespace of the caller. 🫥
• smbuf.mnt_uidmap (since Linux 6.15) — the offset to the location in the smbuf.str buffer that contains uid mappings as consecutive null-terminated strings. they can be iterated over with the help of smbuf.mnt_uidmap_num. the whole range of uid mappings must be resolvable in the user namespace of the caller. ⚠️
• smbuf.mnt_gidmap_num (since Linux 6.15) — the number of gid mappings applied on the mount. if smbuf.mask has STATMOUNT_MNT_GIDMAP set and this field is 0, then gid mappings applied on the mount cannot be resolved in the user namespace of the caller. 🫥
• smbuf.mnt_gidmap (since Linux 6.15) — the offset to the location in the smbuf.str buffer that contains gid mappings as consecutive null-terminated strings. they can be iterated over with the help of smbuf.mnt_gidmap_num. the whole range of gid mappings must be resolvable in the user namespace of the caller. ⚠️
• smbuf.supported_mask (since Linux 6.15) — the ORed combination of STATMOUNT_* flags supported by the current kernel. ✨

---

🌟 RETURN VALUE 🌟

On success, zero is returned. 🎉 On error, -1 is returned, and errno is set to indicate the error. 😔

---

💥 ERRORS 💥

okay bestie, here's the vibe check for when things go sideways. every one of these is <errno>-core, and they all come at you via the usual return-value situation (you know the one — that's the previous section's whole thing, we're not re-litigating it 💅).

• EPERM — permission said no to accessing this mount. rude, but okay. 🚫
• EFAULT — bad pointer alert 🙈 either req or smbuf is pointing at a location outside the process's accessible address space. like, bestie, that memory is not yours to touch.
• EINVAL — you passed an invalid flag in flags. nope, not a real one, try again. ✨
• EINVAL — req is of insufficient size to be utilized. too smol to even work with, tragic. 😭
• EINVAL — you set both req.mnt_ns_id and req.mnt_ns_fd. pick one, it's giving indecisive 💀.
• EINVAL — req.mnt_id or req.mnt_ns_id got specified alongside req.mnt_fd. that's a conflicting-fit situation and the kernel is not here for it. 🙅
• EBADF — req.mnt_fd is an invalid file descriptor. that fd is not fd-ing, fr fr.
• E2BIG — req is too large. big. too big. too much main character energy for this call. 👑
• EOVERFLOW — the size of smbuf is too small to contain either the smbuf.fs_type, smbuf.mnt_root, or smbuf.mnt_point. so the move here is: allocate a larger buffer and retry the call. glow-up the buffer, then run it back. 🦋
• ENOENT — the specified req.mnt_id doesn't exist. it's not there. never was. gone girl. 💀
• ENOMEM — out of memory (i.e., kernel memory). the kernel is broke, not you (well, maybe a little you). 😭

---

🌈 STANDARDS 🌈

Linux. that's it, that's the standard, she's iconic and she knows it 💖

---

👀 SEE ALSO 👀

go read these next, they're the besties of this page:

• listmount(2)
• statx(2)

---

and that's a wrap on statmount(2), bestie!! 🎀 you were reading the Linux man-pages 6.20 version, dated 2026-08-22 — go slay some mounts, stay hydrated, and don't @ me unless you've actually read the ERRORS section 🫶✨💜