Read only bind-mount?

Question

I use mount -o bind to mount directories inside chroots, which works really well. The problem is that I'd like some of these bind-mounted directories to be read only in chroot.

Is it possible? If not - any other way to achieve it?

I was thinking about using NFS for localhost mounts, but it looks like overkill.

Answer 1

Accourding to this is it is possible. You do need a recent kernel.

Answer 2

Direct answer from the LWN article:

mount --bind /vital_data /untrusted_container/vital_data
mount -o remount,ro /untrusted_container/vital_data

Supported since Linux 2.6.26.