mount: rework perparation for pivot_root (v4)

We can't bind-mount the required root into itself instead of
resolving a parent mount.

This patch is required to support userns, because if we want to make
pivot_root, the parent mount can't be locked. When we create userns
and mntns, all inherited mounts are marked as locked.

This patch doesn't change properties of the root mount or any other
mounts of the restored namespace. It is needed to satisfy pivot_root().

v2: don't change properties of the given root
v3: bind-mount root into itself recursevly
v4: A parent of the new root may be a shared mount. In a previous
versions a temporary mount is propogated to its neibours.

Cc: Tycho Andersen <tycho.andersen@canonical.com>
Signed-off-by: Andrey Vagin <avagin@openvz.org>
namespaces: take into account USERNS id

and return an error, if a proccess live in another userns,
because criu doesn't support it.
userns: define protobuf messages for uid and gid maps

Normally, one of the first steps after creating a new user namespace is
to define the mappings used for the user and group IDs of the processes
that will be created in that namespace. This is done by writing mapping
information to the /proc/PID/uid_map and /proc/PID/gid_map files
corresponding to one of the processes in the user namespace.
criu: add constants about user namespaces
userns: save uid-s from a target userns (v2)

We are going to support user namespaces and uid-s will be converted
accoding with userns mappings.

v2: conver id-s for sockets too
dump: dump user namespaces

For that we need to save per-namespace mappings of user and group IDs.

And all id-s for tasks and files are saved from the target user
namespace.
userns: restore per-namespace mappings of user and group IDs (v2)

In this patch we fill /proc/PID/uid_map and /proc/PID/gid_map for the
root task.

v2: initialize groups in a new namespace.
restore:  set PR_SET_DUMPABLE to have access to proc files

It is cleared when a process is forked in a new userns.
zdtm: create devices before forking a test process

Devices can not be created in a new user namespace.
zdtm: prepare a file tree for userns

Here are two issues:
1. All mounts in a new user namespace are locked, so
we need to create a new root mount. We need to bind-mount root to
itself.
2. /proc and /sys must be mounted before umounting /proc and /sys
which were inhereted. It's a security policy.

"""
Author: Eric W. Biederman <ebiederm@xmission.com>
Date:   Sun Mar 24 14:28:27 2013 -0700

    userns: Restrict when proc and sysfs can be mounted

    Only allow unprivileged mounts of proc and sysfs if they are already
    mounted when the user namespace is created.
"""
zdtm: add ability to execute tests in another user namespace

v2: don't forget to initialize groups
zdtm: add tests which can be executed in a new user namespace (v2)

Sockets tests are excluded, because SO_RCVBUFFORCE and SO_SNDBUFFORCE
are protected by CAP_NET_ADMIN

tty*, pty* are excluded, because TIOCSLCKTRMIOS protected by
CAP_SYS_ADMIN

*ghost, *notify, *unlink* are excluded, because linkat(AT_EMPTY_PATH)
are protected by CAP_DAC_READ_SEARCH

v2: use a blacklist
zdtm: check that process w/o file descriptors can be dumped and restored

In addition it checks that criu closes all its descriptors