The SFTP component in OpenSSH provides a chroot-feature for hardening. It is stated in the documentation that the chroot directory must not be writable by the user account, though specific files and subdirectories within it are allowed. Some people were questioning the read-only restriction. halfdog documents some analysis which is the result of discussions on openssh-dev mailing list. Here are some arguments about why these restrictions still makes sense in 2018.
(Score: 2) by canopic jug on Wednesday January 10 2018, @04:20PM
No, but analysis of the issues raised in those discussoins is news. The analisys answers a question that comes up regularly in regards to locked-down SFTP sites and actually walks through why and how the restrictions are needed.
tldr; CVE 2009-2904
Money is not free speech. Elections should not be auctions.