--- a/pkg/security/podsecuritypolicy/provider.go
+++ b/pkg/security/podsecuritypolicy/provider.go
@@ -229,10 +229,27 @@ func (s *simpleProvider) ValidatePodSecurityContext(pod *api.Pod, fldPath *field
                        }

                        if fsType == extensions.HostPath {
-                               if !psputil.AllowsHostVolumePath(s.psp, v.HostPath.Path) {
+                               pathIsAllowed, mustBeReadOnly := psputil.AllowsHostVolumePath(s.psp, v.HostPath.Path)
+                               if !pathIsAllowed {
                                        allErrs = append(allErrs, field.Invalid(
                                                field.NewPath("spec", "volumes").Index(i).Child("hostPath", "pathPrefix"), v.HostPath.Path,
                                                fmt.Sprintf("is not allowed to be used")))
+                               } else if mustBeReadOnly {
+                                       // Ensure all the VolumeMounts that use this volume are readonly
+                                       for i, c := range pod.Spec.InitContainers {
+                                               for j, cv := range c.VolumeMounts {
+                                                       if cv.Name == v.Name && !cv.ReadOnly {
+                                                               allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "initContainers").Index(i).Child("volumeMounts").Index(j).Child("readOnly"), cv.ReadOnly, "must be read-only"))
+                                                       }
+                                               }
+                                       }
+                                       for i, c := range pod.Spec.Containers {
+                                               for j, cv := range c.VolumeMounts {
+                                                       if cv.Name == v.Name && !cv.ReadOnly {
+                                                               allErrs = append(allErrs, field.Invalid(field.NewPath("spec", "containers").Index(i).Child("volumeMounts").Index(j).Child("readOnly"), cv.ReadOnly, "must be read-only"))
+                                                       }
+                                               }
+                                       }
                                }
                        }

--- a/pkg/security/podsecuritypolicy/util/util.go
+++ b/pkg/security/podsecuritypolicy/util/util.go
@@ -173,25 +173,29 @@ func GroupFallsInRange(id int64, rng extensions.GroupIDRange) bool {
        return id >= rng.Min && id <= rng.Max
 }

-// AllowsHostVolumePath is a utility for checking if a PSP allows the host volume path.
-// This only checks the path. You should still check to make sure the host volume fs type is allowed.
-func AllowsHostVolumePath(psp *extensions.PodSecurityPolicy, hostPath string) bool {
+// AllowsHostVolumePath is a utility for checking if a PSP allows the host volume path, and whether volume mounts
+// that use the path are required to be readonly. This only checks the path. You should still check to make sure the host volume fs type is allowed.
+func AllowsHostVolumePath(psp *extensions.PodSecurityPolicy, hostPath string) (pathIsAllowed, mustBeReadOnly bool) {
        if psp == nil {
-               return false
+               return false, false
        }

        // If no allowed paths are specified then allow any path
        if len(psp.Spec.AllowedHostPaths) == 0 {
-               return true
+               return true, false
        }

        for _, allowedPath := range psp.Spec.AllowedHostPaths {
                if hasPathPrefix(hostPath, allowedPath.PathPrefix) {
-                       return true
+                       if !allowedPath.ReadOnly {
+                               return true, false
+                       }
+                       pathIsAllowed = true
+                       mustBeReadOnly = true
                }
        }

-       return false
+       return pathIsAllowed, mustBeReadOnly
 }