I would like even applications not to be able to access /dev/sda .

If possible, I would even like to disallow root applications from accessing it, but that is not as important.

  • 3
    In most (if not all) systems, processes not running as root (or perhaps as a member of some special group, e.g. disks) can’t access /dev/sda unless you change the device node ownership and/or permissions. – Stephen Kitt Jul 10 '18 at 9:13
  • Note that if some partition on /dev/sda is mounted, then applications will be able to access /dev/sda (via the filesystem). If you want to prevent that as well, look at mount namespaces (or chroot). – dirkt Jul 10 '18 at 11:17
  • @dirkt It is not mounted . – neverMind9 Jul 10 '18 at 11:51

I'll assume you're running Linux, since the device name is probably different in other systems.

If your distribution is sane in any way, disk block devices like /dev/sda will be set up so that only root can access them. Debian/Ubuntu have the devices also readable and writable by group disk, but the group has no members unless manually added:

# ls -l /dev/sda
brw-rw---- 1 root disk 8, 0 Jun 19 17:14 /dev/sda

As for preventing root access to the disks, that's not easily done with regular permissions since root overrides the permission bits and has access in any case. Even if you could do that (e.g. by removing the device nodes completely), it would break stuff like blkid, fsck and any tools started by udev. I would expect that to be a bad idea.

Not the answer you're looking for? Browse other questions tagged or ask your own question.