Is there some way that I can block raw write operations to a block device on Linux just as SIP prevents even root from writing directly to certain disks/partitions on OS X El Capitan? This should be something that cannot be bypassed by root, at least in normal operation (for example, root could perform these tasks if Linux is booted with a special argument or before some one-way toggle is set).

These two things do not count:

  • Mounting a partition read-only.
  • Complete read-only protection of a block device that also prevents VFS-level write operations (e.g., dm-verity's read-only enforcement).

How could is be accomplished? Is there any existing solution?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.