work, data, tmp and log should be writable by the user running JBoss. (or those directories should be mapped to writable locations) You might want deploy to be writable by the JBoss user, or you might not. Everything else can be read only to the jboss user.
I’ve looked at a lot of different solutions, and in my humble opinion Aspose is the way to go. Here’s the link: http://aspose.com