moby: Unable to mount within a container even w/ `--cap-add=SYS_ADMIN`

According to docke run reference #Runtime privilege, Linux capabilities, and LXC configuration session, it should enable mount syscall w/ --cap-add=SYS_ADMIN. This is also confirmed by someone who opened #9950 with docker 1.5. Yet it doesn’t work for me now. Is this expected?

How to reproduce

$ docker run --cap-add=SYS_ADMIN -it ubuntu /bin/bash
root@1a6c069a8589:/# cd home/
root@1a6c069a8589:/home# mkdir 1
root@1a6c069a8589:/home# mkdir 2
root@1a6c069a8589:/home# mount --bind 1 2
mount: block device /home/1 is write-protected, mounting read-only
mount: cannot mount block device /home/1 read-only
root@1a6c069a8589:/home# exit
$ docker run --cap-add=ALL -it ubuntu /bin/bash
root@1e04bcd81fee:/# cd home/
root@1e04bcd81fee:/home# mkdir 1
root@1e04bcd81fee:/home# mkdir 2
root@1e04bcd81fee:/home# mount --bind 1 2
mount: block device /home/1 is write-protected, mounting read-only
mount: cannot mount block device /home/1 read-only
root@1e04bcd81fee:/home# exit

--privileged is all right though. FYI.

ENV

docker version: 1.7.1 platform: ubuntu 12.04

/cc @cpuguy83