libnl: Prepare for nested messages (veth creation)

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
net: Implement veth net model

It's perfrctly possible to create veth with peer end right in
the target pid namespace. One only need to properly prepare the
netlink message.

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
test: Test for veth net model

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
api: Add API call for external bind mounts

This one is to bind-mount host directory into container on start.

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
fs: Add flags argument to add_mount call

In the future we'll add at least RO one for sure.

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
ct: Move net and cg structures into proper headers

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
fs: Move mount/umount code into fs.c helpers

We'll add bin dmounts and MOUNTED state, so this is
handy to have this code separated.

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
fs: Add fs_mount object and its manipulations

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
fs: Fix misorder in bind mount arguments

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
fs: Initial implementation of external bind mounts

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
fs: Fix mispring when umounting external mounts

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
test: Add test for private subdir

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
fs: Don't allocate fs_mount->rdst path

Full path to bind mount is "$root/$destination", we
used to calculate this one on ct spawn and save on
the fs_mount structure.

The problem is that bind mount is created by spawned
task and destroyed (sometimes) by master process, and
the latter doesn't know about changes made by former.

Generate full bindmount path always.

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
test: Add test for bind mounts (non NEWNS case)

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
fs,net: Rename freeing functions to match common naming

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
net: When turning off CLONE_NEWNET from nsmask release netcof

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
cg: Helper for type to bit conversion

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
ct: Sanitize ct spawning

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
ct: Handle situation when spawn fails before calling user cb

This can happen if we e.g. fail to mount proc or external
bind mounts or attach to cgroups. In that case we should
report error from spawn API call.

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
ct: Helpers for pipe-based synchronization

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>