Merge pull request #20510 from mheon/powercap_2

Do not add powercap mask if no paths are masked

docs/source/markdown/options/security-opt.md

@@ -31,6 +31,6 @@ Note: Labeling can be disabled for all <<|pods/>>containers by setting label=fal
   for the possible mount options are specified in the **proc(5)** man page.
 
 - **unmask**=_ALL_ or _/path/1:/path/2_, or shell expanded paths (/proc/*): Paths to unmask separated by a colon. If set to **ALL**, it unmasks all the paths that are masked or made read-only by default.
-  The default masked paths are **/proc/acpi, /proc/kcore, /proc/keys, /proc/latency_stats, /proc/sched_debug, /proc/scsi, /proc/timer_list, /proc/timer_stats, /sys/firmware, and /sys/fs/selinux**.  The default paths that are read-only are **/proc/asound**, **/proc/bus**, **/proc/fs**, **/proc/irq**, **/proc/sys**, **/proc/sysrq-trigger**, **/sys/fs/cgroup**.
+  The default masked paths are **/proc/acpi, /proc/kcore, /proc/keys, /proc/latency_stats, /proc/sched_debug, /proc/scsi, /proc/timer_list, /proc/timer_stats, /sys/firmware, and /sys/fs/selinux**, **/sys/devices/virtual/powercap**.  The default paths that are read-only are **/proc/asound**, **/proc/bus**, **/proc/fs**, **/proc/irq**, **/proc/sys**, **/proc/sysrq-trigger**, **/sys/fs/cgroup**.
 
 Note: Labeling can be disabled for all containers by setting **label=false** in the **containers.conf**(5) file.

libpod/container_internal_linux.go

@@ -807,7 +807,7 @@ func (c *Container) getPlatformRunPath() (string, error) {
 }
 
 func (c *Container) addMaskedPaths(g *generate.Generator) {
-	if !c.config.Privileged {
+	if !c.config.Privileged && g.Config != nil && g.Config.Linux != nil && len(g.Config.Linux.MaskedPaths) > 0 {
 		g.AddLinuxMaskedPaths("/sys/devices/virtual/powercap")
 	}
 }