...To setup read-only access a "new root" directory such are "/var/read-only" is created,.Under this directory "/" is mounted as read-only.
Here is a diagram of the directory structure.
/
| | | |
var usr adm <etc>
|
read-only
|
/ (Note: this link is a read-only mount of /)
| | | |
var usr adm <etc> (Note: these directories are picked up even if they are separate mounted filesystems.)
|
read-only
(Note: no it doesn't get cyclic at this point)
When a user logs in, instead of running a shell such as /sbin/sh in the password file, readonlyshell which has suid privileges runs. ...