security - How can I disable root on a modded device?

Is it possible to disable root access to applications on an Android device again after installing modded firmware?

I would like to try Cyanogen or one of the other custom ROMs, but I'm wondering whether that poses a security risk. Do all installed applications get root access automatically, or can that be disabled?

I want to keep the Android security model the way it is or at least for applications to ask for my permission before they can access sensitive data.

Answer

If you install SuperUser you can control which apps are allowed root access. By default it blocks all requests and asks you what you want to do. You can give an app access indefinitely and revoke it at any time, or allow only specific requests with a timeout. Most rooted ROMs come with it pre-installed, including CyanogenMOD, and many rooting methods will install it for you as well.

As an alternative, you could remove the su binary and Busybox from your device to effectively un-root it.