Is there any way to alter the way a Linux distribution handles external drives to only allow read-only unless additional credentials are provided, or at least permanently disable it?Basically need it such that if someone plugs a drive into a system with sensitive data, they cannot copy anything off, even with admin rights. I'm working with Ubuntu 16.04 specifically, and ideally I'd need to do a bunch of setup on the system before disabling this functionality, so I'm not sure if say, modifying and recompiling the OS is possible. Ideally this needs to be a fairly difficult thing to overcome on the machine. 
Locking down external drive reads in a permanent fashion on Linux?
linux;security