The underlying files and directories are in memory so un-mounting the partition is technically safe (I guess).
On the contrary, if a file from a filesystem is open, then unmounting the partition is impossible. A file that is open by a process is not actually loaded into memory when the process opens the file (this would be inefficient, and would even make it completely impossible to work with files that are larger than available memory). Instead, when a file is open, its contents are loaded into RAM as needed, and removed from RAM when the kernel finds better uses for that RAM.
As long as a file is open, that file's content cannot be removed from the filesystem where it is stored. If you delete the file (e.g. with the rm
command), what this really does is to remove the directory entry for that file; but the data remains on the disk until the file is closed. (You can observe this by watching the used disk space: it only goes down when the file is closed, not when an open file is deleted.)
Similarly, if a file is open, you can't unmount its filesystem, since that would make it impossible to retrieve the file's content when needed.
Linux offers the option of a “lazy unmount”. A lazy unmount of a filesystem is comparable to calling rm
on a file: the point at which the filesystem is attached (the mount point) disappears, but the filesystem remains mounted until the last file on it is closed (just like deleting a file detaches it from the directory that contained it but keeps the data on the disk).
All this happens in the kernel. The umount
command doesn't do much, apart from parsing /etc/mtab
to let you specify either the device or the mount point.
If you want to list the processes that have a file open on a filesystem, use fuser or lsof. To kill all the processes that have a file open on a filesystem, run fuser -k /path/to/mount/point
.