LinuxQuestions.org - locked mount points

And I'm bored, so here's the exerpt:
Code:
        async  All I/O to the file system  should  be  done

                    asynchronously.



              atime  Update  inode  access  time for each access.

                    This is the default.



              auto  Can be mounted with the -a option.



              defaults

                    Use default options: rw,  suid,  dev,  exec,

                    auto, nouser, and async.



              dev    Interpret character or block special devices

                    on the file system.



              exec  Permit execution of binaries.



              noatime

                    Do not update inode  access  times  on  this

                    file  system  (e.g, for faster access on the

                    news spool to speed up news servers).



              noauto Can only be mounted explicitly (i.e., the -a

                    option  will not cause the file system to be

                    mounted).



              nodev  Do not interpret character or block  special

                    devices on the file system.



              noexec Do  not  allow  execution of any binaries on

                    the mounted file system.  This option  might

                    be useful for a server that has file systems

                    containing binaries for architectures  other

                    than its own.



            nosuid Do  not  allow  set-user-identifier  or set-

                    group-identifier bits to take effect.  (This

                    seems  safe, but is in fact rather unsafe if

                    you have suidperl(1) installed.)



              nouser Forbid an ordinary (i.e., non-root) user  to

                    mount the file system.  This is the default.



              remount

                    Attempt to remount an  already-mounted  file

                    system.  This is commonly used to change the

                    mount flags for a file system, especially to

                    make  a  readonly  file system writeable. It

                    does not change device or mount point.



              ro    Mount the file system read-only.



              rw    Mount the file system read-write.



              suid  Allow set-user-identifier or set-group-iden-

                    tifier bits to take effect.



              sync  All  I/O  to  the file system should be done

                    synchronously.



              user  Allow an ordinary user  to  mount  the  file

                    system.  The  name  of the mounting user is

                    written to mtab so that he can  unmount  the

                    file  system again.  This option implies the

                    options noexec, nosuid,  and  nodev  (unless

                    overridden  by subsequent options, as in the

                    option line user,exec,dev,suid).



              users  Allow every user to mount  and  unmount  the

                    file  system.    This  option  implies  the

                    options noexec, nosuid,  and  nodev  (unless

                    overridden  by subsequent options, as in the

                    option line users,exec,dev,suid).
Straight from my "man mount" page ;)

So it looks like you'll want:
noauto,users,ro
in your options section (here's my entry for my cdrom):

Code:

/dev/cdrom /mnt/cdrom iso9660 noauto,users,ro 0 0

Cool