On my system, at least,
/var/lock (or actually
/run/lock, the former is a symlink to the latter) has the sticky bit set. That means that only the owner of the lockfile or directory can delete it, not anyone with write on the directory (the same way
/tmp works). On other distros, the directory only writable by a few users (so random users can't mess with it at all).
So the only users who can mess with (delete) your daemon's lockfile are:
root (as of course root can do anything)
- the user you're creating the lockfile as (sounds like
root again, but could also be a dedicated user for your daemon if you weren't trying to
- the owner of the lock directory,
root on my system
Or if its set up the other way, you can add in "members of the
lock (or whichever) group", which is generally only users for system daemons.
The users who can read/write your lockfile are controlled by permissions on the lockfile like normal—and writing is hopefully limited to root and your daemon's user.
root is causing "external interference" you have far bigger problems than him/her
rm'ing a lockfile. So you shouldn't do this—it doesn't add any protection, and may cause surprises for the sysadmin when trying to fix some problem.
The immutable flag is something that is normally only applied by the sysadmin.