ubuntu-cloud: changes to support unprivileged use

don't try to lock if using a specified tarball

The lock/subsys/lxc-ubuntu-cloud lock is to protect the tarballs
managed under /var/cache/lxc/cloud-$release.  Don't lock if we've
been handed a tarball.

fake device creation

Unprivileged users can't create devices, so bind mount null, tty, urandom
and console from the host.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
send current cgroup to lxc_cgroup_create()

This is needed if we're going to have unprivileged users
create containers inside cgroups which they own.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
A few changes for unprivileged lxc-start

When doing reboot test, must add clone_newuser to clone flags, else
we can't clone(CLONE_NEWPID).

If we don't have caps at lxc-start, don't refuse to start.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
cgroup: don't set devices cgroup if not in init_user_ns

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
fix chowning of tty and console uids

It needs to be done from the handler, not the container, since
the container may not have the rights.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>