Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm working on creating a bootable Linux CD to distribute a sandbox environment to customers that will work on multiple PCs.

One requirement of this environment is that we do not want the user to have any access to the underlying hard drives in the computer to prevent any accidental and/or malicious damage. I can prevent the disks from automounting with a few udev custom rules, but is there any way to prevent/block the user from manually mounting the hard drives after boot up.

share|improve this question
Are they root ? – Sirex Jan 25 '11 at 10:57
If the customer can boot from a CD, he can boot from any CD. Don't forget that. – grawity Jan 25 '11 at 16:25
@grawity, a very valid point. I carry a custom livecd around w/ my when I go on travel. Some hotels offer a computer room where you can go for access if you dont have a laptop but usually they're very badly virus laden/key logged. If i'm 'allowed' to, i will boot up and run my own system. Having access to everything. Must also watch out for bootable thumbdrives and even memory cards nowadays... – g19fanatic Jan 25 '11 at 18:51
up vote 2 down vote accepted

Usually mount requires root priviledges. So long as they are not given access in visudo nor belong to a group that has priviledges to run mount , you will be okay. Some systems will 'auto' mount drives. Be sure that the one you are trying to distribute doesnt do that (or you modify and 'customize' it so that doesn't).

A simple way to test this would be to just issue an ls -l command in the directory of mount and check the permissions. If they do not have the rights, you're set. If they do, then you will need to be editing some groups priviledges.

share|improve this answer
Thanks for pointing this out, it seems obvious now you say it but didn't occur to me. We will be disabling root access so this will work nicely – JamieH Jan 25 '11 at 13:37
np! also if you custom livecd is developed off of ones that auto mount (such as Knoppix or Fedora's live cd's, by default)... Be sure to 'custom' build them to not allow the automounting... – g19fanatic Jan 25 '11 at 18:49

Customize the kernel on the Live cd, take out drivers to pata, sata, and scsi controllers. If they have no drivers for it, they cant mount it, regardless of whether they got root or not. And if you're super paranoid, also compile the kernel without the ability to load modules, so even if they built a module for the disk controller elsewhere, they cannot load it after startup. Or don't use modules at all and just compile everything into the kernel.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .