If I have a disk mounted on my hard-drive, I want to be able to block all but specific processes from having read/write access to that disk. Currently, I'm thinking the best way is to audit the disk and kill the processes when seen accessing files in the disk, but are there any methods to stop those processes before they actually access them?
Let me elaborate with an example. For example, I might want to block all processes from reading from and writing to a mounted disk except vim. So, if an unauthorized user calls
touch /mnt/mounteddisk/foo then I would block that.
I would also assume that there's a big difference between having access to a disk and having access to files inside the disk. For example, the former would block calling
ls on the mounted disk directory, and the latter wouldn't. But the latter could block
vim trying to read a file inside the disk. I am currently looking for the former.