You have to restrict Physical access. If someone has physical access to your computer (hard drive) they have root access, regardless of OS.
This is why they keep servers in locked rooms =)
Second best is an encrypted installation. That will make it difficult or impossible for someone with physical access to access your data, assuming the computer is shut off and they do not install a modified kernel.
To further refine my answer, now that you have asked about setting up a kiosk ..
First, you need root access via some mechanism, sudo or su, take you pick, to perform system administration. Since completely disabling sudo , su, or all root access is unrealistic. With what you have posted, I would look at locking down your kiosk with apparmor (take a look at the apparmor profile for the gurest account as a template).
If you do not know how to use apparmor, use a distro that is built as a kiosk. Why re-creating the wheel?
1) Use Ubuntu with the guest account. The guest account is confined by apparmor:
2) There are other options
Fedora makes a kiosk spin, locked down with selinux
3) Other distors