You need a write only device.

You could boot from a CD/DVD which is write only.

Or possibly an SD card that has the write-lock enabled.

If the computer does not support an SD card you could use usb card reader to boot from.

Of course in the worst case situation someone smart enough could rewrite the BIOS and get around any boot device.

Who can talk about (intel or arm) boot? I'm looking at a problem that can be solved by setting up a device at boot time and not letting the OS have the privilege or perhaps the physical ability to change it...

--dave

-- 
David Collier-Brown,         | Always do right. This will gratify
System Programmer and Author | some people and astonish the rest
davecb@spamcop.net           |                      -- Mark Twain

---
Talk Mailing List
talk@gtalug.org
https://gtalug.org/mailman/listinfo/talk

-- 
Alvin Starr                   ||   voice: (905)513-7688
Netvel Inc.                   ||   Cell:  (416)806-0133
alvin@netvel.net              ||