What is the effect of setting immutable bit on /boot partition with perspective of security. is it advisable to set the immutable bit (-i) to everything under /boot? Will it enhance or degrade the system security?I would like to go further and do the same for other precious files like /etc/bind/named.conf, etc. 
What is the effect of setting immutable bit on /boot partition
debian;filesystems;security;boot;xattr
TL;DRDon't do this unless you have peculiar auditing requirements. It's generally more trouble than it's worth.ExplanationThe only account that should have write access to /boot is root. If you have root, you can unset immutable bits and pretty much do what you want anyway.The major downside of mounting /boot read-only, setting immutable bits, or anything similar is that you will need to undo those settings every time you update your kernel or boot loader. This is much more likely to trip you up than it is to offer meaningful security.AlternativesDepending on what you're really trying to do, you may have some alternatives. For example:Ensuring that /boot is on a separate partition that is rarely written to is a good idea if you're worried about filesystem corruption.Periodically validating the contents of /boot with Tripwire or debsums, especially when comparing against hashes stored on separate read-only media, is a good security measure if you're worried about tampering.Mounting /boot read-only, and then having your package manager mount it read-write during updates, may be useful.Remounting Read-Only Partitions During Apt UpdatesAs an example the last alternative, you might configure /boot read-only in your /etc/fstab, then add something similar to the following to your /etc/apt/apt.conf on Debian-based systems:DPkg {    Pre-Invoke { mount -o remount,rw /boot; };    Post-Invoke {        test ${NO_APT_REMOUNT:-no} = yes ||        mount -o remount,ro /boot ||        true;    };};This will keep /boot read-only except during updates. Obviously, you will need to do something different if you aren't using the apt package manager, or if the above doesn't work for some other reason.