I would like even applications not to be able to access /dev/sda .
If possible, I would even like to disallow root applications from accessing it, but that is not as important.
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.Sign up to join this community
I'll assume you're running Linux, since the device name is probably different in other systems.
If your distribution is sane in any way, disk block devices like
/dev/sda will be set up so that only
root can access them. Debian/Ubuntu have the devices also readable and writable by group
disk, but the group has no members unless manually added:
# ls -l /dev/sda brw-rw---- 1 root disk 8, 0 Jun 19 17:14 /dev/sda
As for preventing root access to the disks, that's not easily done with regular permissions since
root overrides the permission bits and has access in any case. Even if you could do that (e.g. by removing the device nodes completely), it would break stuff like
fsck and any tools started by
udev. I would expect that to be a bad idea.