I've been looking for solutions for Linux that can disable/deny attempts to write directly to block devices—preferably only certain ones like the boot disk (as with Apple's SIP)—while still permitting writes at the filesystem-level.
grsecurity is the first project I found that had this solution and is where I'm getting the idea from. The trouble with theirs is that I don't need (nor care for) the rest of what it provides and that it is too sweeping. Any block device that is mounted read-only or is unmounted will itself be made read-only (i.e., you can't run
dd if=/dev/zero of=/dev/sda1) and they can't be (re)mounted read-write if they are like that at the time of activating the protection. Looking at their code, I managed to write a kernel module (and a kernel patch with a one-way sysctl entry) that did the same thing. I later modified the kernel module to only block raw write operations to
/dev/sda1 based on name. Then, I rewrote it again to only block writes based on major number since I didn't know how to handle non-canonical paths.
I abandoned the kernel because a module is so much easier, but it would be even easier if I knew how to write code that could determine the boot device and its parent so I don't have to hard code the numbers. So, I've resorted to searching for a solution with Google as I figured it would be a common idea (without the targeting of the boot disk). My results have only been about raw devices, write blockers for forensics, and raw IO as it relates to memory. What would be the terminology that is used to describe a system that prohibits writing directly to data storage devices?