I just set up some workstations that I was required to disable CDROM access for normal users, but retain it for root. The easiest way, with the least amount of impact, is to disable GNOME’s automounting from the gnome-volume-manager program. This program mounts devices and removable media (DVDs, CDs and USB flash drives) when they are inserted into the system.
gconftool-2 --direct --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory --type bool --set /desktop/gnome/volume_manager/automount_media false gconftool-2 --direct --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory --type bool --set /desktop/gnome/volume_manager/automount_drives false
You can then verify the changes by viewing the output of:
gconftool-2 -R /desktop/gnome/volume_manager
Another, less elegant method to accomplish this task is to relocate the cdrom driver. You can always put it back as root and insmod to reactivate it.
mv /lib/modules/<kernels>/drivers/cdrom/cdrom.ko /root