README: think through special cases

think through special cases for older kernels.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Update cross-namespace behavior

As per the newly added section to README:

If we are on an older kernel, the only calls we want to reject are
MovePidAbs.  The others will confuse the caller, but not compromise
the host.

On newer kernels we do want to avoid calls which can only confuse
the caller, so require a proxy for those.  There is no good case for
allowing those calls.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
move_pid: stick to what the README says

If the kernel does not support /proc/pid/ns/pid, then don't
require an scm call.  Rather, require that the target pid be
in a child cgroup of the proxy.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
cgmanager_chown_main: don't fail for root on old kernel

If our kernel doesn't do user namespaces, still allow root
to chown.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
test19: give the test something to escape from

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
test19: final cg may not be original

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>