I was curious about this too, so went digging. The immutability is handled by "nearly", created for blendOS: https://github.com/blend-os/nearly https://github.

I was curious about this too, so went digging. The immutability is handled by "nearly", created for blendOS: https://github.com/blend-os/nearly https://github.com/blend-os/nearly (In turn, "nearly" is called by the "blend" package manager, e.g., "sudo nearly enter rw", "sudo nearly enter ro" - https://github.com/blend-os/blend/blob/main/blend https://github.com/blend-os/blend/blob/main/blend) At the heart of "nearly" is toggling inode flag "FS_IMMUTABLE_FL" (equivalent to "chattr +i" / "chattr -i") on each file within specified directories (currently "/usr"): https://github.com/blend-os/nearly/blob/3bb6f662818545cba1eb2d506b1c4a941649c7a3/core/mode.go#L93 https://github.com/blend-os/nearly/blob/3bb6f662818545cba1eb...