openSUSE Leap adds a new security layer: Immutable mode

openSUSE Leap is adding an immutable mode beginning with version 16.1, according to the official openSUSE blog cited by ZDNET. The blog states that "Leap 16.1 is the first Leap release to offer an Immutable Mode, a transactionally updated system with a read-only root filesystem," describing it as what users know from Leap Micro, integrated directly into Leap.

Leap Micro is described as a specialized, lightweight, immutable, fixed-release operating system for containerized workloads, edge computing, and virtualized environments; Leap Micro is not a desktop OS, while Leap is. The blog states Leap Immutable "is the way forward for container and virtual machine hosts, edge devices and anyone who prefers atomic updates with easy rollback." An ISO of Leap 16.1 that includes immutable mode is available from the official openSUSE download server.

Immutable mode is a feature that can be toggled during installation, so users choose between the standard and immutable versions of openSUSE Leap. In immutable mode, the root filesystem is mounted read-only, and directories such as /usr and /etc are mounted read-only and cannot be altered.

openSUSE already includes security features. Up to version 15.6 it used AppArmor as its mandatory access control feature; starting with version 16.0 it switched to SELinux, which labels every file, process, and port and follows the rule of least privilege. The distribution uses firewalld for firewall management, includes binary hardening measures such as position-independent executables, FORTIFY_SOURCE, stack protector, relocation read-only, and non-executable stack and heap, and provides permission profiles. It also uses Btrfs snapshots managed by Snapper for rolling back to a working point. openSUSE is built directly from source code from SUSE Enterprise Linux.