> /usr/local is not immutable, nor is /usr/share Not technically, but I've built a number of "appliance" linux systems for clients, and to improve reliability

> /usr/local is not immutable, nor is /usr/share Not technically, but I've built a number of "appliance" linux systems for clients, and to improve reliability I just make the entire disk read-only with the exception of /home and /var. The few locations outside of /var that sometimes need to be writable (in particular, /media, /mnt, and sometimes /root) can simply be symlinked into /var.