mount: mount everything read-only