Re-mount /root as read-only