 +		free(dpath);
 +	}
 +	closedir(dir);
- 	/* Mount tmpfs at new cgroup directory */
- 	if (mount("tmpfs", cgroup_path, "tmpfs", MS_NODEV|MS_NOSUID, options) == -1) {
- 		pr_perror("%s: Failed to mount tmpfs at %s", id, cgroup_path);
+ 	if (remount_readonly(id, cgroup_path, cgroup_path) < 0) {
+ 		return -1;
+ 	}
 -- 
-2.19.1
+2.7.4
 

 
 	if (asprintf(&cgroup_path, "%s/%s", rootfs, CGROUP_ROOT) < 0) {
 		pr_perror("%s: Failed to create path for %s", id, CGROUP_ROOT);
@@ -290,6 +295,46 @@ static int mount_cgroup(const char *id, const char *rootfs, const char *options,
 		pr_perror("%s: Failed to mkdir new dest: %s", id, cgroup_path);
 		return -1;
 	}
+	/* Create all additional cgroup mounts which are in the root namespace */

 1 file changed, 45 insertions(+)

diff --git a/src/systemdhook.c b/src/systemdhook.c
index c2cb2b9..f9ec9f2 100644
--- a/src/systemdhook.c
+++ b/src/systemdhook.c
@@ -274,6 +274,11 @@ static char *get_process_cgroup_subsystem_path(const char *id, int pid, const ch
 static int mount_cgroup(const char *id, const char *rootfs, const char *options, char *systemd_path)
 {
 	_cleanup_free_ char *cgroup_path = NULL;
