hm, maybe I'm just being a bit of a joykill, but if you don't want them to mount floppys, cdroms, and usbsticks, (and if they're not supposed to be mounting anything at all) couldn't you just
root@localhost# chown root.root `which mount` && \
chmod go-rwx `which mount`
And be done with it?
Also, if the floppy, cdrom, and usbstick devices all belong to respective groups, couldn't you just rip the users out of the groups in the /etc/group file?
Matt's right; physical security is essential. Otherwise anyone could stick in a Knoppix CD and use whatever devices they liked to their heart's content.
Paul.
