<i>&gt;How can you stop malware fiddling with bits to allow installation of extensions?</i><p>Require signed extensions - and have the code that does the signing check be locked for modification (e.g. 755 root in &#x2F;usr&#x2F;)