Call me paranoid.
 Actually, you can use restricted or password in the global section
as well, not just in an image definition. However, I like having
different passwords for each image, so I don't put 'password' in the
global section. Restricted, on the other hand, is fine if you want
them all restricted.
 chattr only works on ext2/ext3 file systems.
 Most BIOS can disable or password-protect the ability to boot off
other devices. I leave that as an exercise for the reader so we can
get onto more interesting topics again next week.