Add a rootless concept to it to represent the OEM state. (E.g. in MacOS where /usr/local represents user changes, if it's deleted, the OS is back in OEM state)

Add a rootless concept to it to represent the OEM state. (E.g. in MacOS where /usr/local represents user changes, if it's deleted, the OS is back in OEM state) Android actually came pretty close to this, if you ignore the vendor messups when it comes to partitioning. Due to lack of alternatives, my current "secure deployment" strategy is to use containers that have only a kernel, no shell, and "CGO_enabled=0" go binaries that don't link against C libraries. Even if they segfault it's close to impossible to guess the offsets correctly to be able to create an exploit for it. The only attack surface left is what's mounted in the container, and you have full control over that. But applying this to a desktop system is the hard part. QubedOS has nice ideas, but is unusable by unexperienced users. Something like a distro that makes it a first priority to ship apparmor and selinux profiles for every package might be a way to get there, but it's a huge load of work.