Don't mount basic filesystems in userns mode

Also don't put the sudoers file under /run.
Call unshare after cloning the process
Tweak pivot_root for userns
userns: newer kernels disallow clearing supplementary groups

Too bad.  IMHO using groups as anti-capabilities is bogus.
http://seclists.org/oss-sec/2014/q4/653