mount read-only where possible