From df25eddce6dce1e1123372bc6ccf98d7b3acc0ce Mon Sep 17 00:00:00 2001
From: Michael Crosby <crosbymichael@gmail.com>
Date: Fri, 1 Apr 2016 13:04:47 -0700
Subject: [PATCH] Add spec support for masked and readonly paths

Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
---
 libcontainer/specconv/spec_linux.go | 21 ++-------------------
 spec.go                             | 14 ++++++++++++++
 2 files changed, 16 insertions(+), 19 deletions(-)

diff --git a/libcontainer/specconv/spec_linux.go b/libcontainer/specconv/spec_linux.go
index be5ee4676..b490eb42b 100644
--- a/libcontainer/specconv/spec_linux.go
+++ b/libcontainer/specconv/spec_linux.go
@@ -41,23 +41,6 @@ var mountPropagationMapping = map[string]int{
 	"":         syscall.MS_PRIVATE | syscall.MS_REC,
 }
 
-var (
-	maskedPaths = []string{
-		"/proc/kcore",
-		"/proc/latency_stats",
-		"/proc/timer_stats",
-		"/proc/sched_debug",
-	}
-	readonlyPaths = []string{
-		"/proc/asound",
-		"/proc/bus",
-		"/proc/fs",
-		"/proc/irq",
-		"/proc/sys",
-		"/proc/sysrq-trigger",
-	}
-)
-
 var allowedDevices = []*configs.Device{
 	// allow mknod for any device
 	{
@@ -226,8 +209,8 @@ func CreateLibcontainerConfig(opts *CreateOpts) (*configs.Config, error) {
 	}
 	config.Cgroups = c
 	// set extra path masking for libcontainer for the various unsafe places in proc
-	config.MaskPaths = maskedPaths
-	config.ReadonlyPaths = readonlyPaths
+	config.MaskPaths = spec.Linux.MaskedPaths
+	config.ReadonlyPaths = spec.Linux.ReadonlyPaths
 	if spec.Linux.Seccomp != nil {
 		seccomp, err := setupSeccomp(spec.Linux.Seccomp)
 		if err != nil {
diff --git a/spec.go b/spec.go
index 78246d0eb..9ca85cdf1 100644
--- a/spec.go
+++ b/spec.go
@@ -141,6 +141,20 @@ container on your host.`,
 				},
 			},
 			Linux: specs.Linux{
+				MaskedPaths: []string{
+					"/proc/kcore",
+					"/proc/latency_stats",
+					"/proc/timer_stats",
+					"/proc/sched_debug",
+				},
+				ReadonlyPaths: []string{
+					"/proc/asound",
+					"/proc/bus",
+					"/proc/fs",
+					"/proc/irq",
+					"/proc/sys",
+					"/proc/sysrq-trigger",
+				},
 				Resources: &specs.Resources{
 					Devices: []specs.DeviceCgroup{
 						{