Read-only access to binaries within app

[jdstrand]

This is the same functionality that came up here: Classic confinement request: draftman.