We use the
accounts subsystem to hold /home, then Justin applied the
Bind Mount Extensions patch (BME) to remount it read-only in other
subsystems, while keeping it read-write accounts/home.
For this, you need to:
mount --bind -o ro /subsystems/ssname/home
/subsystems/accounts/home /subsystems/arch/home none bind,ro
If you use -o remount,(ro|rw) then the change is applied to every mount point (so don't).