dump: pre-load kernel modules

See the comment below for an explanation of what is going on. We will
ultimately need to handle dumping the netlink data, but I think it is good to
prevent injecting events into the stream during a dump. So we pre-load the
modules, even though it isn't very pretty.

Signed-off-by: Tycho Andersen <tycho.andersen@canonical.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
travis: add compilation of tests

Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
ns: Introduce ns walking helper

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
net: Use ns walking helper

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
mnt: Clean up namespaces walking code

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
mnt: Use ns walking helper

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
pstree: Add helper for adding helpers to pstree

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
dump: don't play with a function exit code

We should not have a chance to exit with a wrong code on error paths.

Now dump_one_task() returs zero, if allocation of dfds failed:

ret = collect_mappings(pid, &vmas);
if (ret) {
	pr_err("Collect mappings (pid: %d) failed with %d\n", pid, ret);
	goto err;
}

if (!shared_fdtable(item)) {
	dfds = xmalloc(sizeof(*dfds));
	if (!dfds)
		goto err;

...
err:
	return -1;

Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
syscall: add memfd_create() (v3)

v2: Follow the kerndat style that "features" are described
just by global boolean variables.

v3: give NULL as a name to get EFAULT if memfd_create is supported
shmem: rework getting file descriptors for shared memory regions (v2)

/proc/PID/map_files are protected by the global CAP_SYS_ADMIN, so we
need to avoid using them to support user namespaces.

We are going to use memfd_create() to get the first file descriptor and
then all others processes will able to open it via /proc/PID/fd/X.

This patch reworks slave processes to not use map_files.

v2: add more comments
shmem: use memfd_create() to restore shared memory reqions (v2)

/proc/PID/map_files are protected by the global CAP_SYS_ADMIN, so we
need to avoid using them to support user namespaces.

We are going to use memfd_create() to get the first file descriptor and
then all others processes will able to open it via /proc/PID/fd/X.

In this patch memfd_create() is used to get a file descriptor, which is
associated with a shared memory region.

If memfd_create() isn't supported, the old scheme will be used.

v2: don't set a name for memfd. It isn't required.
zdtm/maps01: extend maps01

It's bad idea to have only one target object.
In addition I add a shared region to the second process,
which is not mapped in the first.
mount: rework perparation for pivot_root (v2)

We can't bind-mount the required root into itself instead of
resolving a parent mount.

This patch is required to support userns, because if we want to make
pivot_root, the parent mount can't be locked. When we create userns
and mntns, all inherited mounts are marked as locked.

v2: don't change properties of the given root

Cc: Tycho Andersen <tycho.andersen@canonical.com>
Signed-off-by: Andrey Vagin <avagin@openvz.org>
zdtm: add a test to check non-root shared bind-mounts

Here is an example from a fedora container:
65 64 252:0 /vz/private/1 / rw,relatime shared:29 - ext4 /dev/mapper/centos_pcs-root rw,data=ordered
77 65 252:0 /vz/private/1/var/tmp/systemd-httpd.service-XLnJPNc/tmp /var/tmp rw,relatime shared:41 - ext4 /dev/mapper/centos_pcs-root rw,data=ordered

We can see non-root shared mount, which is mounted to the root
mount from the same shared group. The test emulates this situation.
Revert "mount: don't create a temporary directory for pivot_root()"

This reverts commit 21d1b2fdb97facf88436d083896311367e4398af.

pivot_root() can move the current root to a non-shared mount. So we are
going to create a temporary private mount in put_old.
mount: don't mark mounts as private twice

We do the same action twice. It's typo.
mntns: pivot_root() can move the current root to a non-shared mount

So we need to create a temporary private mount for the old root.
mount: don't add extra / between a temporary root and mountpoint

Currenlty a generated path contains two slashes successively.
mount: move code to validate shared mounts in a separate function
mntns: rework validation to support non-root shared bind-mounts

Currently we can restore shared bind-mounts only if they have the same
set of children. But if we have a non-root bind-mount, we should compare
children, which are accessiable from both mounts.

Now we take the next mount in the shared group, which is wider or equal
to current and compare children between them.