Make use of PR_SET_NO_NEW_PRIVS if available

This flag is exactly what we want for this tool (it's what I thought
SECBIT_NOROOT did).

See the linked discussion from here:

http://lwn.net/Articles/504879/
Exit immediately if clone() fails

This happens when run recursively.
Release 2012.2
Use MS_MOVE of / rather than chroot()

chroot() breaks some tools that expect / to be an actual mount point.
Doing namespace manipulation is cleaner than chroot().

See http://lists.freedesktop.org/archives/systemd-devel/2012-September/006703.html
"[systemd-devel] OSTree mount integration"
Only MS_MOVE the root to / if the root isn't already /

Otherwise the MS_MOVE call aborts.
build: use AC_SYS_LARGEFILE

So we will do the right thing on 32 bit.
[SECURITY] Invoke chdir() after we've switched uid, not before

Otherwise, the user can access otherwise inaccessible directories like:

$ linux-user-chroot --chdir /root/.virsh / /bin/sh

Reported-by: Ryan Lortie <desrt@desrt.ca>
Reported-by: Marc Deslauriers <marc.deslauriers@canonical.com>
[SECURITY] Use fsuid to lookup bind mount paths and chroot target

Otherise, the user can access otherwise inaccessible directories like
this:

$ linux-user-chroot --mount-bind /root/.virsh ~/mnt / /bin/sh

Also, we should check the accessibility of the chroot target; this is
much harder to exploit because you'd need an executable inside the
chroot that can be run.

Reported-by: Marc Deslauriers <marc.deslauriers@canonical.com>
Reported-by: Ryan Lortie <desrt@desrt.ca>
Reviewed-by: Marc Deslauriers <marc.deslauriers@canonical.com>
Signed-off-by: Colin Walters <walters@verbum.org>
Release 2013.1