On a desktop/laptop, root doesn't have anything even remotely as interesting as your own user. What you are arguing for is pure security theater.
replyIt’s much easier to insert persistent malware when you can modify the operating system. I remember Windows viruses that would disable windows update. Very annoying!
replya virus that disables windows update? Sounds like an actual sellable product to me!
replyWait until you find out I use passwordless sudo. Surely you can't really believe that every Linux laptop is horribly compromised.
replyIf you're going to insist on being one of those hardcore "I must be root" people then there's nothing I can say that will satisfy your urge. The same if you are one of those permanent Apple bashers.
replyHowever, for the benefit of more sensible people, I will point out:
1. I used the terminology "layered security" twice in my post above
2. By definition if you have a blind hatred of Apple SIP, you must also have a hatred of SELinux or AppArmor or dm-verity or kernel lockdown mode on Linux.Does Apple SIP allow you to change the configuration per app? I thought now, which is a big difference with SELinux or Apparmor.
replyAFAIK, no. SIP is for the whole system, period.
replyI think we could say AppArmor is more akin to TCC on macOS, though AppArmor would be much more flexible.