How? How do you get immutability from SELinux policies (specifically without crafting detailed policies for everything running in the entire userland--at which

How? How do you get immutability from SELinux policies (specifically without crafting detailed policies for everything running in the entire userland--at which point you're just begging for a distro, right?)? Honestly, if you really want something immutable and distro-agnostic, you probably want something like btrfs snapshots; however, converting the root filesystem to btrfs is probably a pain, and there will be some initial configuration to prepare some cloud-init, ignition, etc before you take your initial snapshot and you'll also probably want to configure some "boot from snapshot" type functionality, at which point it would be pretty nice to have all of this packaged up in a distro so each user doesn't have to figure all of that out every time.