No magic bullet
Of course it isn't a magic bullet. Existing security in both the Windows and Unix-derived worlds is too close to being perimeter-only for safety. We need at least three things to make life difficult for malware and for ransomware in particular.
First, instead of accessing storage on their own user processes should go through a back-end with specific permissions. My particular experience of this is with Informix where normal usage is to assign one or more allocations of raw disk, chown informix:informix, chmod 660 but this idea isn't specific to a particular product.
Secondly, introduce a concept of application permissions that sits alongside user permissions. The backend might, for instance be run by user and group odf-storage and only accept read/write requests from odf-user which would own the likes of LibreOffice and OpenOffice applications and even then only honour requests that matched the user's permissions.
Thirdly, and this is where something like Apple's idea comes in, the kernel would lock root out from changing such storage on its own account; it would need to be authorised by a specific user, such as odf-admin for instance, to de-allocate odf storage.
There are a good many practical difficulties is this, primarily in maintaining the chain of authenticity through updates. But Unix security has been watered down over the years in the name of convenience and Windows, starting as a single user system, has found it difficult to build security in and their problems won't be addressed by simply wringing our hands when things get hard.
It would also help if email had signing built in as part of the core protocol, web-advertising would just die and web 2.0 designers didn't rely on hauling in bits of code from sites over which they have no control.
