Something like fsverity could be a decent half solution. https://fedoraproject.org/wiki/Changes/FsVerityRPM https://fedoraproject.org/wiki/Changes/FsVerityRPM

Something like fsverity could be a decent half solution. https://fedoraproject.org/wiki/Changes/FsVerityRPM https://fedoraproject.org/wiki/Changes/FsVerityRPM Of course you won't have that layer of isolation if something becomes compromised, but it should make it harder for malicious code to persist on your system without you knowing.