Restricting Mounting Local HDDs

[DoomUs]

Is there a way I could remove a driver/module, or even the "mount" command to restrict a user from mounting local hard drives?

I really only want this to be "default" behavior, so if a user implements a mechanism, or finds a way to "mount", I don't care. It doesn't need to be a bullet-proof prevention, I would just prefer that on boot, (from a live-cd) the local HDDs are not mounted automatically, and further, the "mount" or similar commands are disabled.

Again, whether it's trivial to circumvent or not is unimportant to me, I'm only looking for a default behavior.

Thanks.

[rokytnji]

From a live CD of what?

Remastersys

[DoomUs]

Well, whatever's easiest really. Recently, I've been playing with Slax and Porteus, which are easy to create modules for, so one of those ideally. This mounting restriction is more important than easy modules though, so I'm willing to look at any distro if that makes it easier.

[atreyu]

It sounds like you are spinning a Live CD of your own, yes? Well, just be sure that nothing in the init scripts (/etc/rc.sysinit, /etc/rc, etc.) tries to perform any auto-mounting of hard drives. Also, make sure that there are no drives listed in /etc/fstab. Look at the contents of a normal Linux install and you'll see something like /dev/sda or UUID=blahblah or LABEL="blah" - those refer to hard drive partitions that will get auto-mounted (typically, but that depends on the options in the 4th column).

Also, yes, you can simply move /bin/mount to /bin/mount.orig or something. Or remove the executable bit. Simple to overcome, but you said you didn't care...

EDIT:
You do need the mount binary during the boot process for mounting stuff other than hard drives (/proc, /dev, /sys, tmpfs, etc.) so don't just rename mount as I suggested above unless you do it as a final command, after everything else is done (like put it in /etc/rc.local, for example).

[DoomUs]

Also, yes, you can simply move /bin/mount to /bin/mount.orig or something. Or remove the executable bit. Simple to overcome, but you said you didn't care...

EDIT:
You do need the mount binary during the boot process for mounting stuff other than hard drives (/proc, /dev, /sys, tmpfs, etc.) so don't just rename mount as I suggested above unless you do it as a final command, after everything else is done (like put it in /etc/rc.local, for example).

This is good information. Thanks for your help.