3 ms·Is root prevented from directly writing to the underlying block device?by eternauta3k 1y agoIs root prevented from directly writing to the underlying block device?kstrauser 1y agoYes.messe 1y agoOnly if securelevel is 2. If securelevel = 1, then only mounted filesystems are RO. An attacker could conceivably forcibly unmount /var/log as root, and make the changes directly to the block device.