Suppose that a regular linux machine is compromised by an attacker who obtained a root shell, he can modify the system kernel or modify boot loader to load another kernel.
Is there a way to prevent such modifications?
I want to disable such things for a regular linux os (not a container) installed on a regular pc with only one regular hard disk. I don't want to use read only mediums like cdrom.
A rough theoretical solution is to patch kernel to disallow modifications to MBR plus another area of hard disk (maybe a partition) and store kernel and boot loader files in that area.