README.md: add new entry

Signed-off-by: Giuseppe Scrivano <[email protected]>

Author: giuseppe

README.md

@@ -629,6 +629,21 @@ tells userspace that there was an fd, but it was not allowed through.
 
 **Use-Case:** Any code that wants to use `SCM_RIGHTS` properly.
 
+### Block writes to /proc/self/exe and /proc/self/map_files
+
+Provide a security primitive that prevents processes from writing to
+`/proc/self/exe` and `/proc/self/map_files`. This directly addresses
+the attack vector used in CVE-2019-5736.
+
+A common workaround used by container runtimes to prevent an untrusted
+container process from overwriting the host's runtime executable is to
+"re-exec" themselves from a read-only copy of the binary.
+
+While this looks like a kernel issue, the assumption is still that any
+container runtime must ensure its binary cannot be overwritten.
+
+**Use-Case:** Any container runtime that executes an untrusted executable.
+
 ---
 
 ## Finished Items