I'd like to know how to make files completely immutable. "Completely" refers in this case to: immutable while the system is running. I could live with something like physical access where someone e.g uses a live cd to change the immutable files on a harddrive. I'm not worried about physical access that much.
I know there is chattr -i which makes a file immutable. Of course some hacker could just change the attribute back. According to the debian security manual (https://www.debian.org/doc/manuals/securing-debian-howto/ch4.en.html#s4.17 under 4.17.2) you can prevent this by removing the CAP_LINUX_IMMUTABLE capability and making lcap itself immutable. According to this site: https://www.win.tue.nl/~aeb/linux/lk/lk-7.html you also have to remove CAP_SYS_RAWIO because it allows to patch the running kernel code. This is not mentioned in the debian manual.
Also from crossreading some other sites regarding sandboxing on linux, seccomp etc I gathered that kernel exploits in principle can bypass such systems with reduced capabilities. But I'm not sure if this also holds true for my case.
I'm assuming the attacker has complete (except physical) access to my system. Will the capability based approach above prevent him from changing the immutable file X on my system? If not is there anything I could do in order to accomplish this?