The best protection is to do chattr +i on all binaries and shared objects in /bin, /lib and /usr, and only lift it for upgrades. Possibly also for everything un

The best protection is to do chattr +i on all binaries and shared objects in /bin, /lib and /usr, and only lift it for upgrades. Possibly also for everything under /etc except /etc/mtab. And for everything under /boot, preferably mounting it read-only if it's on a separate fs. It might get really annoying really fast though and only iron discipline will prevent you from forgetting to chattr +i something back after chattr -i to do an upgrade. And if you have such a good discipline, you're extremely unlikely to ever do a rm -rf /*. It would be nice if you could have some hook in the package manager so you could write something to automatically chattr -i relevant files and then chattr +i them back. And a vim macro to do the same when you save a file in /etc.