chmod readonly, user should explicitly +x