So I have a Python app (which spawns other processes) which I want to deny any writing. It seems like a job for SELinux. Could you describe the steps needed to accomplish this, or perhaps direct me to some good reading resource, since from what I've found there aren't too many.
Under every OS, it's quite hard to do this, at the moment. Chrome developers have made some progess in this area, but it's still hard. They came with a solution about 22k lines of code (LOC) for Win* systems and 11k LOC for Linux.
In recent news, FreeBSD 9.0 was announced with Capsicum, a framework designed for this purpose, but it can work only on *BSD systems.
On Linux, you can avoid SELinux or AppArmor using seccomp. See this LWN article for more details and sample usage. But it's really hard: it's an all or nothing feature for system calls like read or write.
There is currently a new approach on-going in the LKML, using Berkeley Packet Filter, see this post of Will Drewry.