zdtm/maps01: extend maps01

It's bad idea to have only one target object.
In addition I add a shared region to the second process,
which is not mapped in the first.
restore: use new interface to set mm arguments
mount: rework perparation for pivot_root

We can't bind-mount the required root into itself instead of
resolving a parent mount.
namespaces: take into account USERNS id

and return an error, if a proccess live in another userns,
because criu doesn't support it.
userns: define protobuf messages for uid and gid maps

Normally, one of the first steps after creating a new user namespace is
to define the mappings used for the user and group IDs of the processes
that will be created in that namespace. This is done by writing mapping
information to the /proc/PID/uid_map and /proc/PID/gid_map files
corresponding to one of the processes in the user namespace.
criu: add constants about user namespaces
userns: parse /proc/PID/{u,g}id_map
userns: save uid-s from a target userns

v2: don't leak maps
    convert uids-s after may_dump()
userns: restore gid and uid maps
namespace: don't fail if a namespace isn't supported by kernel

CRIU reads /proc/pid/ns/[NS] and fails of a link is not exist.
restore:  set PR_SET_DUMPABLE to have access to proc files

It is cleared when a process is forked in a new userns.
zdtm: create devices before forking a test process

Devices can not be created in a new user namespace.
zdtm: prepare a file tree for userns

Here are two issues:
1. All mounts in a new user namespace are locked, so
we need to create a new root mount. We need to bind-mount root to
itself.
2. /proc and /sys must be mounted before umounting /proc and /sys
which were inhereted. It's a security policy.

"""
Author: Eric W. Biederman <ebiederm@xmission.com>
Date:   Sun Mar 24 14:28:27 2013 -0700

    userns: Restrict when proc and sysfs can be mounted

    Only allow unprivileged mounts of proc and sysfs if they are already
    mounted when the user namespace is created.
"""
zdtm: add ability to execute tests in another user namespace
namespace: append a null byte after readlink

readlink() does not append a null byte to buf.
zdtm: add tests which can be executed in a new user namespace

Sockets tests are excluded, because SO_RCVBUFFORCE and SO_SNDBUFFORCE
are protected by CAP_NET_ADMIN

tty*, pty* are excluded, because TIOCSLCKTRMIOS protected by
CAP_SYS_ADMIN

*ghost, *notify, *unlink* are excluded, because linkat(AT_EMPTY_PATH)
are protected by CAP_DAC_READ_SEARCH