 simple approxmation to this make usr a separate partion and mount it read only the good news attackers that want to trojan your software have to reboot at least the bad news administrators that want to update your software have to reboot at least no reboot is required you just need to remount it mount o remount rw usr this requires root access but presumably usr is safe from non root users anyway only way to disable this is to have the kernel compiled with something that compartmentalizes capabilities lids etc on linux for example or to remove cap_sys_admin with lcap which would definately require a reboot and possibly break some other functionatily to boot pun intended my apologies brian hatch are you expected systems and no dreaded security engineer URL every message pgp signed 