make build tree read-only