I want to create a puppy linux-based liveCD that will boot the entire system to RAM and access the wireless card to act as a router, without any possibility of accessing the hard disk. I am using an Atheros based wifi card which supports turning the card into a wireless access point, which we used the other day for a reletively small game of Wolfinstein: Enemy Territory.
I would prefer that the live environment has as little access to the hard disk as possible, i.e., no ability whatsoever to mount /dev/(s/h)dax, both for my own security and to assure whoever else has such a card that absolutely nothing can happen to their hard disk.
So is there any kernel parameter or boot script I should modify to make this happen?

I'm not too familiar with puppy but I know Fedora has "livecd-creator". This might have some turn-key options for you.

I think you could easily remove the options to mount any drives by default. That way the drive wouldn't be mounted but if need be you could. If your really interested in keeping the user from accessing the hard drive I think you would have to remove hardware support for all IDE and SCSI controllers. The issue I see with that is that you need an IDE/SCSI controller to access the live CD.

As an alternative...
You might try a live USB thumb drive. This would allow you to remove all support for SCSI and IDE from the kernel but still be able to access USB devices (i.e. your disk) and escape the problem above.

You could modify the hardware detection software in your live-CD to ignore all hard drives.

Or replace 'mount' with a custom application using the same name, that ignores hard drives. You could till keep a copy of the original 'mount' under a different name, so that at least you could mount anything in case of need.

I'm not sure if removing 'mount' completely will work - some tools will certainly depend on it's existence.

Linux Archive

If you will only be using this computer as a router, and it will always boot up from the CD, you could simply remove the drive.

What kernel module is needed to access the drive. For example, if it uses sata_nv, then you could rebuild the kernel without sata_nv support.

A router will often use a 2.4 kernel and producing a flat kernel without module support may make sense. As a bonus, without LKM support, an LKM rootkit can't be loaded.