-2

I would like even applications not to be able to access /dev/sda .

If possible, I would even like to disallow root applications from accessing it, but that is not as important.

Improve this question
3
  • 3
    In most (if not all) systems, processes not running as root (or perhaps as a member of some special group, e.g. disks) can’t access /dev/sda unless you change the device node ownership and/or permissions.
    – Stephen Kitt
    Jul 10, 2018 at 9:13
  • Note that if some partition on /dev/sda is mounted, then applications will be able to access /dev/sda (via the filesystem). If you want to prevent that as well, look at mount namespaces (or chroot).
    – dirkt
    Jul 10, 2018 at 11:17
  • @dirkt It is not mounted .
    – neverMind9
    Jul 10, 2018 at 11:51

1 Answer 1

Reset to default
1

I'll assume you're running Linux, since the device name is probably different in other systems.

If your distribution is sane in any way, disk block devices like /dev/sda will be set up so that only root can access them. Debian/Ubuntu have the devices also readable and writable by group disk, but the group has no members unless manually added:

# ls -l /dev/sda
brw-rw---- 1 root disk 8, 0 Jun 19 17:14 /dev/sda

As for preventing root access to the disks, that's not easily done with regular permissions since root overrides the permission bits and has access in any case. Even if you could do that (e.g. by removing the device nodes completely), it would break stuff like blkid, fsck and any tools started by udev. I would expect that to be a bad idea.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .