| Disabling CTRL-ALT-DELETE rebooting is designed to prevent an attacker with access to the machine's keyboard from being able to reboot the machine. A reboot done in this manner should not damage the file system, as it shuts the machine down cleanly, writing out all pending data in the disk cache to disk first. Even with this functionality disabled, however, an attacker could just power cycle machine or pull the power cord.
Unless the power line, switch and case of the machine can be physically protected, this precaution is wholly unnecessary. Given the fact that the attacker _can_ reboot the machine, would you prefer that s/he do it in a way potentially damages the file system? Think carefully here, as maintaining the integrity of the machine's file system may be secondary to the goal of keeping an attacker off, in which case it is better to answer yes here, since having to repair/ignore the damage and wait for file system checks may slow the attacker down. |