To do it properly you would likely be looking at mandatory access control, such as SELinux, so that the ransomware wouldn't be authorized to modify the files and further would make itself obvious in the logs. Not very easy to use (in a way that still provides meaningful security) outside of the server space, though it can be done.