Mount propagation of virtual kernel filesystems and read-only option - linux-kernel

Question

I'm trying to mount /sys and /sys/kernel/security as read-only on custom location with slave mount propagation. With kernel below 4.15 read-only option propagates to the original mount /sys/kernel/security. With newer kernel version it doesn't propagate, so it looks like there was a bug in kernel fixed, but it doesn't propagate even if the custom mountpoint (here /mnt/root/sys) is shared. How to explain this?
Steps to reproduce:
# mkdir -p /mnt/host_root/sys
# mount -o ro -t sysfs sys /mnt/host_root/sys
# mount --make-rslave /mnt/host_root/sys
# mount -o ro -t securityfs securityfs /mnt/host_root/sys/kernel/security
Result on CentOS 7 (kernel 3.10) or Ubuntu 18.04 LTS (kernel 4.15):
$ findmnt -o TARGET,PROPAGATION,OPTIONS
TARGET PROPAGATION OPTIONS
/ shared rw,relatime,errors=remount-ro,data=ordered
├─/sys shared rw,nosuid,nodev,noexec,relatime
│ ├─/sys/kernel/security shared ro,nosuid,nodev,noexec,relatime
│ ├─/sys/fs/cgroup shared ro,nosuid,nodev,noexec,mode=755
│ │ ├─/sys/fs/cgroup/unified shared rw,nosuid,nodev,noexec,relatime,nsdelegate
│ │ ├─/sys/fs/cgroup/systemd shared rw,nosuid,nodev,noexec,relatime,xattr,name=systemd
│ │ ├─/sys/fs/cgroup/devices shared rw,nosuid,nodev,noexec,relatime,devices
│ │ ├─/sys/fs/cgroup/memory shared rw,nosuid,nodev,noexec,relatime,memory
│ │ ├─/sys/fs/cgroup/rdma shared rw,nosuid,nodev,noexec,relatime,rdma
│ │ ├─/sys/fs/cgroup/net_cls,net_prio shared rw,nosuid,nodev,noexec,relatime,net_cls,net_prio
│ │ ├─/sys/fs/cgroup/hugetlb shared rw,nosuid,nodev,noexec,relatime,hugetlb
│ │ ├─/sys/fs/cgroup/cpu,cpuacct shared rw,nosuid,nodev,noexec,relatime,cpu,cpuacct
│ │ ├─/sys/fs/cgroup/blkio shared rw,nosuid,nodev,noexec,relatime,blkio
│ │ ├─/sys/fs/cgroup/freezer shared rw,nosuid,nodev,noexec,relatime,freezer
│ │ ├─/sys/fs/cgroup/cpuset shared rw,nosuid,nodev,noexec,relatime,cpuset
│ │ ├─/sys/fs/cgroup/perf_event shared rw,nosuid,nodev,noexec,relatime,perf_event
│ │ └─/sys/fs/cgroup/pids shared rw,nosuid,nodev,noexec,relatime,pids
│ ├─/sys/fs/pstore shared rw,nosuid,nodev,noexec,relatime
│ ├─/sys/kernel/debug shared rw,relatime
│ ├─/sys/fs/fuse/connections shared rw,relatime
│ └─/sys/kernel/config shared rw,relatime
├─/proc shared rw,nosuid,nodev,noexec,relatime
│ └─/proc/sys/fs/binfmt_misc shared rw,relatime,fd=25,pgrp=1,timeout=0,minproto=5,maxproto=5,direct,pipe_ino=12645
├─/dev shared rw,nosuid,relatime,size=1996564k,nr_inodes=499141,mode=755
│ ├─/dev/pts shared rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000
│ ├─/dev/shm shared rw,nosuid,nodev
│ ├─/dev/hugepages shared rw,relatime,pagesize=2M
│ └─/dev/mqueue shared rw,relatime
├─/run shared rw,nosuid,noexec,relatime,size=403944k,mode=755
│ ├─/run/lock shared rw,nosuid,nodev,noexec,relatime,size=5120k
│ ├─/run/user/1000 shared rw,nosuid,nodev,relatime,size=403940k,mode=700,uid=1000,gid=1000
│ └─/run/docker/netns/default shared rw
├─/boot shared rw,relatime,block_validity,barrier,user_xattr,acl
├─/tmp shared rw,relatime,size=1048576k
└─/mnt/root/sys private ro,relatime
└─/mnt/root/sys/kernel/security private ro,relatime
Result on Ubuntu 22.04 LTS (kernel 5.15), mount --make-rslave /mnt/host_root/sys is skipped
$ findmnt -o TARGET,PROPAGATION,OPTIONS
TARGET PROPAGATION OPTIONS
/ shared rw,relatime
├─/sys shared rw,nosuid,nodev,noexec,relatime
│ ├─/sys/kernel/security shared rw,nosuid,nodev,noexec,relatime
│ ├─/sys/fs/cgroup shared rw,nosuid,nodev,noexec,relatime,nsdelegate,memory_recursiveprot
│ ├─/sys/fs/pstore shared rw,nosuid,nodev,noexec,relatime
│ ├─/sys/fs/bpf shared rw,nosuid,nodev,noexec,relatime,mode=700
│ ├─/sys/kernel/debug shared rw,nosuid,nodev,noexec,relatime
│ ├─/sys/kernel/tracing shared rw,nosuid,nodev,noexec,relatime
│ ├─/sys/fs/fuse/connections shared rw,nosuid,nodev,noexec,relatime
│ └─/sys/kernel/config shared rw,nosuid,nodev,noexec,relatime
├─/proc shared rw,nosuid,nodev,noexec,relatime
│ └─/proc/sys/fs/binfmt_misc shared rw,relatime,fd=29,pgrp=1,timeout=0,minproto=5,maxproto=5,direct,pipe_ino=24581
│ └─/proc/sys/fs/binfmt_misc shared rw,nosuid,nodev,noexec,relatime
├─/dev shared rw,nosuid,relatime,size=1951612k,nr_inodes=487903,mode=755,inode64
│ ├─/dev/pts shared rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000
│ ├─/dev/shm shared rw,nosuid,nodev,inode64
│ ├─/dev/hugepages shared rw,relatime,pagesize=2M
│ └─/dev/mqueue shared rw,nosuid,nodev,noexec,relatime
├─/run shared rw,nosuid,nodev,noexec,relatime,size=401680k,mode=755,inode64
│ ├─/run/lock shared rw,nosuid,nodev,noexec,relatime,size=5120k,inode64
│ ├─/run/user/1000 shared rw,nosuid,nodev,relatime,size=401676k,nr_inodes=100419,mode=700,uid=1000,gid=1000,inode64
│ ├─/run/credentials/systemd-sysusers.service shared ro,nosuid,nodev,noexec,relatime,mode=700
│ └─/run/docker/netns/default shared rw
├─/boot shared rw,relatime
└─/mnt/root/sys shared ro,relatime
└─/mnt/root/sys/kernel/security shared ro,relatime