fix readonlyPath as well

readonlyPath's first MS_BIND might inherit some lockable flags, so in a
user ns, we need to make sure to pass these flags back to the MS_REMOUNT.

Signed-off-by: Tycho Andersen <tycho@docker.com>

libcontainer/rootfs_linux.go

@@ -723,7 +723,15 @@ func readonlyPath(path string) error {
 		}
 		return err
 	}
-	return unix.Mount(path, path, "", unix.MS_BIND|unix.MS_REMOUNT|unix.MS_RDONLY|unix.MS_REC, "")
+
+	statfs := unix.Statfs_t{}
+	if err := unix.Statfs(path, &statfs); err != nil {
+		return err
+	}
+
+	flags := statfs.Flags | unix.MS_BIND | unix.MS_REMOUNT | unix.MS_RDONLY | unix.MS_REC
+
+	return unix.Mount(path, path, "", uintptr(flags), "")
 }
 
 // remountReadonly will remount an existing mount point and ensure that it is read-only.