There are only 3 (that I can readily think of) ways of denying root access to a file (on normal filesystems).
- Filesystem is mounted in read-only.
- The file is immutable (
chattr +i). Root is able to change the attributes and remove the immutable flag, but this is a manual process as applications dont automatically do this. This is commonly used to prevent accidentally writing to files.
- The file is a running executable. The kernel prevents modification of any executable which is currently running. You can unlink (
rm) the file, but you cannot modify its contents.
Now there are lots of other ways of denying write access to a file when using root. Network filesystems like NFS and CIFS can deny root access if configured to do so on the server. Some other special filesystems, like mvfs from IBM Rational ClearCase, can do this as well.
However with all this said, there arent any standard files that root isnt able to write to. A distribution can set files with the immutable flag sure, but its not standard.