Re: Writes to mounted devices containing file-systems.

[Matt]

Anton Altaparmakov mentioned the following:

| Anyway, the kernel could never provide you with ultimate security without
| sacrificing all functionality. Once they get in, they will get root and
| once they have root you have lost, you need to have a system without a
| root user and with nobody having capabilities to do things like load
| modules, etc... There are so many local exploits that you would lose
| for sure. If the attacker cannot write to raw device, he will unmount and
| then write to it or he will load a module to send commands to your HD at
| ATAPI or SCSI level and kill your hd that way...

Couldn't you run something like LIDS? This can be used to lock permissions
down so that root can't unmount filesystems, write to raw devices, etc.

Matt