Is there some way that I can block raw write operations to a block device on Linux just as SIP prevents even root from writing directly to certain disks/partitions on OS X El Capitan? This should be something that cannot be bypassed by root, at least in normal operation (for example, root could perform these tasks if Linux is booted with a special argument or before some one-way toggle is set).
These two things do not count:
- Mounting a partition read-only.
- Complete read-only protection of a block device that also prevents VFS-level write operations (e.g., dm-verity's read-only enforcement).
How could is be accomplished? Is there any existing solution?