Comment # 30 on bug 1181970 from Franck Bui

To discover the process that masks the mount units, you can try to use auditd.

Please follow the following steps to enable auditd and add the relevant rules
to monitor the symlinks:

 - make sure that the mount units are no more masked, maybe reboot so you
   start with a clean state

 - make sure auditd is enabled and running with `systemctl status auditd`

 - clear all existing rules with `auditctl -D`

 - add the rules to monitor the creation of the symlinks:

   auditctl -w /run/systemd/system/var.mount -p w -k mask-var-mounts
   auditctl -w /run/systemd/system/var-run.mount -p w -k mask-var-mounts

 - verify that the rule has been added: `auditctl -l`

After that just wait until var.mount or var-run.mount get masked again then
attach the output of `ausearch -i -k mask-var-mounts`.