clang: Fix some simple issues

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
oracle template: restrict writeability in /proc and /sys

Note that since we don't drop CAP_SYS_ADMIN, root in the container can
remount proc or sys however they want to, however this at least improves
the default situation.

Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
apparmor: cache the are-we-enabled decision

Since we check /sys/kernel/security/ files when deciding whether
apparmor is enabled, and that might not be mounted in the container,
we cannot re-make the decision at apparmor_process_label_set() time.
Luckily we don't have to - just cache the decision made at
lsm_apparmor_drv_init().

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
Fix build failure on sparc

Signed-off-by: Thomas Nemeth <thomas.nemeth@laposte.net>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
clang: Remaining changes

Those are a bit less obvious than those I pushed directly to master.
All those changes were required to build LXC under clang here.

With this, gcc can be replaced by clang to build LXC so long as you're
not using the python3 binding (as python extensions can't be built under
clang at the moment).

For reference, the clang output for those is: http://paste.ubuntu.com/6292460/

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
strtoul: check errno

In a few places we checked for LONG_MIN or LONG_MAX as indication
that strtoul failed.  That's not reliable.  As suggested in the
manpage, switch to checking errno value.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>