I want to set up an SBC, e.g. Raspberry Pi, Banana Pi, to work as close as possible to a computer running a Live Distro. I'm intending to use this to inspect suspicious or infected storage drives and view their contents. I'm not necessarily looking to do forensics on them (although if I did, I assume I can just apply these principles to a Kali installation). I'm aware that the Raspberry Pi is capable of botting from USB, so booting a Live CD should be possible, but I don't want to restrict my options to just the Raspberry Pi, so I want I'm considering the normal set up with these computers with the operating system on an SD card.
If I were to:
- mount all filesystems as read-only
- create and autologin to a non-root,non-privileged user
- remove root privileges from privileged users/delete privileged users
- completely disallow root login
Can I be confident that no malware compromising the system can make any permanent changes to it?