Merge branch 'services-r6' into services-r7

Conflicts:
	services

Change-Id: I3596f89c0331eecf3269951a5ec350f9a97da16b
Add warden: manager for ephemeral Linux containers

Change-Id: I3913e5be6392ffec183e9eb58d933988c15deafb
Add ability to specify initial list of users via cc config

Initial users can now be specified via the 'bootstrap_users' property of the CC config
file. This commit is in preparation for removing the remote_ip check during user creation.

Test plan:
- New unit tests pass.
- Added the 'bootstrap_users' section to my config, verified that I was able to login as the users.
- BVTs pass locally
- BVTs pass on my deployment

Change-Id: Ib1db51862058335ddb6c6220cb6038ea07d85511
Remove 'local_register_only' and add 'allow_registration'.

The existing implementation of 'local_register_only' had a security hole.
Moreover, I'm not sure that it's possible to implement the intent of 'local_register_only'
in Rails/EM safely. We would need to grab the socket for the current request and call getpeername()
on it.

We attempt to provide similar functionality to 'local_register_only' by allowing users to disable
registration and provide seed users to be created at startup. The seed users can then be used to
register additional users.

Test plan:
- New unit tests pass
- Ran CC locally with/without allow_registration set and verified the correct behaviour with vmc.
- BVTs pass locally
- BVTs pass on my deployment

Change-Id: Ib1c96304f7a7364b913a8a09f7178f85857cd46d
warden: Move separate concerns to their own files

This also includes prep work for supporting execution environments that
are less secure than LXC. This is required for MCF, OSX, dev, etc.

Change-Id: I82ee0aef3dce60ea0f174598663b9d78ab89bb6c
checked in user pools and em_run supporting library to common.

Change-Id: Id52c6920f286e33082857683d5cb1828237b74ca
Merge "checked in user pools and em_run supporting library to common."
small fix to close_fds path.

Change-Id: I9fe2b1f682b50c5b88b4b22bc40c9767eab819d0
some cleanup on error messages, and fix of include path.

Change-Id: Ice165fece59c5e962114f57390b8fbdb015d92cd
Merge "some cleanup on error messages, and fix of include path."
small logging fixes.

Change-Id: Ia5a917b309ec79361361d14c6546348ed546f943
warden: More prep work to support both LXC and insecure

Change-Id: I886d7de9244bfd60ba8c2dea72f5857d3c1d4e73
Merge "Add warden: manager for ephemeral Linux containers"
Merge "Add ability to specify initial list of users via cc config"
Merge "Remove 'local_register_only' and add 'allow_registration'."
warden: Implement insecure handler

The insecure handler does not try to jail the container in any way.
Scripts run in insecure containers have access to the full file system,
network interfaces, process table, etc. They are run as the user that
runs warden.

Change-Id: Ia5eeed8fb0df1f67750eebe1cd69cf86e7c552f7
warden: Move common code to base class

Change-Id: I8c8d22ca4008822342d4abb5ccbadc81724c43d8
bug fix in error handler.

Change-Id: Ie93c91dc6084ebd031ff1d3393f7327bb74b9b87
Merge "bug fix in error handler."
warden: Support spawn/link semantics

This enables client connections to go away without killing the scripts
that it started. Clients can reconnect and re-attach to the scripts they
started to wait until completion, or to reap the status when the script
has already exited.

Change-Id: Id9b89f241d9bba89b5ea211b5737d957ca48c62a