add a --timeout configuration
use C++11 noreturn attribute
move some globals into main
use a nested, unique cgroup for each container

Closes #4
rm write access to urandom
syscall whitelisting via argument and file
add gentab script
add dependencies to Makefile
some cleanup/fixes for the syscall code
syscalls.h isn't really a header
use std::pair for syscall_pair
make gcc happy
execve is always needed, whitelist it by default
add a README
report a non-zero exit status or thrown signal

This needs to be done to distinguish errors thrown by playpen from the
ones in the sandboxed child.
use `nobody` as the default user
better handling of SIGCHLD
Merge branch 'devel' of git://github.com/vodik/playpen