diff --git a/libcontainer/integration/exec_test.go b/libcontainer/integration/exec_test.go
index ae7ecc41..d8b6e16b 100644
--- a/libcontainer/integration/exec_test.go
+++ b/libcontainer/integration/exec_test.go
@@ -845,6 +845,15 @@ func TestMountCgroupRO(t *testing.T) {
 	mountInfo := buffers.Stdout.String()
 	lines := strings.Split(mountInfo, "\n")
 	for _, l := range lines {
+		if strings.HasPrefix(l, "tmpfs on /sys/fs/cgroup") {
+			if !strings.Contains(l, "ro,nosuid,nodev,noexec") {
+				t.Fatalf("Mode expected to contain 'ro,nosuid,nodev,noexec': %s", l)
+			}
+			if !strings.Contains(l, "mode=755") {
+				t.Fatalf("Mode expected to contain 'mode=755': %s", l)
+			}
+			continue
+		}
 		if !strings.HasPrefix(l, "cgroup") {
 			continue
 		}
@@ -880,6 +889,15 @@ func TestMountCgroupRW(t *testing.T) {
 	mountInfo := buffers.Stdout.String()
 	lines := strings.Split(mountInfo, "\n")
 	for _, l := range lines {
+		if strings.HasPrefix(l, "tmpfs on /sys/fs/cgroup") {
+			if !strings.Contains(l, "rw,nosuid,nodev,noexec") {
+				t.Fatalf("Mode expected to contain 'rw,nosuid,nodev,noexec': %s", l)
+			}
+			if !strings.Contains(l, "mode=755") {
+				t.Fatalf("Mode expected to contain 'mode=755': %s", l)
+			}
+			continue
+		}
 		if !strings.HasPrefix(l, "cgroup") {
 			continue
 		}
diff --git a/libcontainer/rootfs_linux.go b/libcontainer/rootfs_linux.go
index d0334154..78e51224 100644
--- a/libcontainer/rootfs_linux.go
+++ b/libcontainer/rootfs_linux.go
@@ -186,6 +186,7 @@ func mountToRootfs(m *configs.Mount, rootfs, mountLabel string) error {
 			Device:      "tmpfs",
 			Destination: m.Destination,
 			Flags:       defaultMountFlags,
+			Data:        "mode=755",
 		}
 		if err := mountToRootfs(tmpfs, rootfs, mountLabel); err != nil {
 			return err
@@ -218,6 +219,13 @@ func mountToRootfs(m *configs.Mount, rootfs, mountLabel string) error {
 		if err := os.Chdir(cwd); err != nil {
 			return err
 		}
+		if m.Flags&syscall.MS_RDONLY != 0 {
+			// remount cgroup root as readonly
+			rootfsCgroup := filepath.Join(rootfs, m.Destination)
+			if err := syscall.Mount("", rootfsCgroup, "", defaultMountFlags|syscall.MS_REMOUNT|syscall.MS_RDONLY, ""); err != nil {
+				return err
+			}
+		}
 	default:
 		return fmt.Errorf("unknown mount device %q to %q", m.Device, m.Destination)
 	}