Check your laptop's BIOS at boot, look around for options like hard drive encryption or "ATA Hard Disk Lock" (not encryption, but I don't think most drives have any mechanism that would allow you to bypass the password).
You can shoot epoxy into the firewire port to prevent them from attaching a PCI memory reader debugging tool.
Update
The fact that it's Linux gives you some more flexibility. :) You can remove the usbhid.ko
, hid.ko
, and similar kernel modules from the system. Look through lsmod(8)
output and remove anything that looks like it'd be useful for the trackpad or keyboard or nipple-mouse. Delete the firewire modules. Maybe even the serial and parallel modules. (If you're not using them, it won't hurt to be rid of them.)
You'll need to lock down grub
as well, so that your client can't just edit the kernel boot line and add init=bash
or init=getty /dev/ttyS01
or something else similarly annoying.
You might also want to use a tool such as AppArmor, SElinux, TOMOYO, or SMACK. Any of these mandatory access control tools can prevent an application from escaping a well-defined set of privileges. As I've worked on the AppArmor system for a decade now, it's the one I know best and the one I'd recommend :) but any of these tools can help lock down every mechanism that your client can interact with the computer.
(To tell a small diversionary tale, we took an AppArmor-confined system to the DEFCON Capture The Flag contest for several years; one year required allowing users to telnet in as root with a specific password. AppArmor made it easy to confine the telnetd
daemon, the shell it started, and then the programs that the 'scorebot' needed to run. We never won the CTF contests, but we never got rooted, either. We never needed to worry about physical attacks because everyone who was defending was known to us.)
Best of luck.