I like ChromeOS' security model: Nail everything shut, but leave a Linux VM as a escape hatch.