Disable Single User Mode

Question

If I forget my password to my Raspberry Pi, I can gain access again by using single user mode (here is an alternative link). The upside is that if I don't know my password, I can gain access. The downside is that if anyone doesn't know my password they can gain access.

Is it possible to prevent unauthorized access via single user mode?

As far as I have researched, the answer is no. I write to ask this question in the hope that either:

1. You can show me that I am wrong and that it is possible to disable single user mode; or
2. I can achieve my end goal (security of my user data) via some other means, even though any nefarious actors that gain physical access to my Raspberry Pi will be able to gain sudo access.

Answer 1

Put the data you're trying to protect on a separate partition and encrypt it. Typical users will want to encrypt /home. You could also encrypt the root partition itself, though that will be more difficult to set up and maintain.

On an encrypted machine, the person who gains physical access will only be able to see the unencrypted data. In case of root partition encryption, the only thing they will be able to see from single-user mode is the initramfs.

Note that with physical access it will still be possible to destroy your data. There's no way around that: worst case, one can always smash your Pi with a hammer.

Answer 2

This is IMPOSSIBLE.

If others have physical access to the system there is nothing you can do to prevent access.
This pretty much applies to all computer systems.

The access (more commonly referred to as a root shell) gives access to everything (unless it is encrypted).

Others have resorted to extreme measures e.g. glueing the SD Card in the Pi - this means, it ever it fails the Pi is inaccessible.