originally reported by Patrick William of Rack911Labs.
note: this has a slight (but unavoidable) potential for
breakage for containers that need a rw /sys for whatever
reason. those should already have set "lxc.mount.auto" to
contain "sys:rw" (or use a custom AA profile), because
remounting /sys rw is only possible with trickery inside the
container even without this patch.