start user NS when asked to activate
unshare pid namespace using clone (compatiblity with pre-3.7)