proc: parse state and ppid from /proc/pid/status (v2)

v2: don't leak FILE

CID 73423 (#1 of 1): Resource leak (RESOURCE_LEAK)
15. leaked_storage: Variable f going out of scope leaks the storage it points to.
dump: move the may_dump() check in seize_task()

It's a bad idea to a group of processes and only then check
rights for this operation. We need to check permissions a soon as
posible to reduce impacts in case of wrong permissions.

In addtion criu doesn't to parse /proc/pid/state and gets all required
infromation from /proc/pid/status.
proc: delete parse_pid_stat_small()

It's unused now.
userns: save uid-s from a target userns (v2)

We are going to support user namespaces and uid-s will be converted
accoding with userns mappings.

v2: conver id-s for sockets too
dump: dump user namespaces

For that we need to save per-namespace mappings of user and group IDs.

And all id-s for tasks and files are saved from the target user
namespace.
userns: restore per-namespace mappings of user and group IDs (v2)

In this patch we fill /proc/PID/uid_map and /proc/PID/gid_map for the
root task.

v2: initialize groups in a new namespace.
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

v3: add a helper to initialize creds in a new userns
restore:  set PR_SET_DUMPABLE to have access to proc files

It is cleared when a process is forked in a new userns.
zdtm: create devices before forking a test process

Devices can not be created in a new user namespace.
zdtm: prepare a file tree for userns

Here are two issues:
1. All mounts in a new user namespace are locked, so
we need to create a new root mount. We need to bind-mount root to
itself.
2. /proc and /sys must be mounted before umounting /proc and /sys
which were inhereted. It's a security policy.

"""
Author: Eric W. Biederman <ebiederm@xmission.com>
Date:   Sun Mar 24 14:28:27 2013 -0700

    userns: Restrict when proc and sysfs can be mounted

    Only allow unprivileged mounts of proc and sysfs if they are already
    mounted when the user namespace is created.
"""
zdtm: add ability to execute tests in another user namespace

v2: don't forget to initialize groups
zdtm: add tests which can be executed in a new user namespace (v2)

Sockets tests are excluded, because SO_RCVBUFFORCE and SO_SNDBUFFORCE
are protected by CAP_NET_ADMIN

tty*, pty* are excluded, because TIOCSLCKTRMIOS protected by
CAP_SYS_ADMIN

*ghost, *notify, *unlink* are excluded, because linkat(AT_EMPTY_PATH)
are protected by CAP_DAC_READ_SEARCH

v2: use a blacklist
userns: check that all namespaces were created from a target userns

We enter into the target userns and try to enter in other namespaces.
The "enter" operation requires CAP_SYS_ADMIN in a user namespace,
where a taget namespace was created.

Now if one or more namespaces were created in another userns,
criu stops dumping and return an error. I want to find someone, who uses
this configuration. In this case restore will be more complicated.
Current version covers containers needs.
flock: blocked processes are not interesting for us

All out processes are stopped in a moment, when file locks are
collected, so they can't to wait any locks.

Here is a proof of this theory:
[root@avagin-fc19-cr ~]# flock xxx sleep 1000 &
[1] 23278
[root@avagin-fc19-cr ~]# flock xxx sleep 1000 &
[2] 23280
[root@avagin-fc19-cr ~]# cat /proc/locks
1: FLOCK  ADVISORY  WRITE 23278 08:03:280001 0 EOF
1: -> FLOCK  ADVISORY  WRITE 23280 08:03:280001 0 EOF
[root@avagin-fc19-cr ~]# gdb -p 23280
(gdb) ^Z
[3]+  Stopped                 gdb -p 23280
[root@avagin-fc19-cr ~]# cat /proc/locks
1: FLOCK  ADVISORY  WRITE 23278 08:03:280001 0 EOF

Currently criu can dump nothing, if we have one process which is
waiting a lock. I don't see any reason to do this.

Cc: Qiang Huang <h.huangqiang@huawei.com>
Reported-by: Mr Jenkins
coverity
sysfs: fix use_after_free issue

CID 73379 (#1 of 1): Use after free (USE_AFTER_FREE)
31. deref_arg: Calling fclose dereferences freed pointer fp.
shmem: don't unmap a memrory region in restore_shmem_content()

This function doesn't allocate memory, so it should not release it.

CID 73380 (#1 of 1): Use after free (USE_AFTER_FREE)
14. deref_arg: Calling munmap dereferences freed pointer addr.
cgroups: fix use_after_free issue

list_for_each_entry_safe() should be used, you we are going to delete
something from a list.

CID 73383 (#1 of 1): Read from pointer after free (USE_AFTER_FREE)
4. deref_after_free: Dereferencing freed pointer prop.

Cc: Tycho Andersen <tycho.andersen@canonical.com>
restore: don't leak a transport socket

CID 73354 (#1 of 1): Resource leak (RESOURCE_LEAK)
9. leaked_handle: Handle variable sock going out of scope leaks the handle
cgroup: don't use fread in read_cgroup_prop()

I think this version of code is a bit more readable.
It doesn't do memcpy and doesn't allocate FILE.
Everyone knows arguments for read(), but only a few of
us know arguments for fread().

CID 73345 (#1 of 1): String not null terminated (STRING_NULL)
2. string_null_argument: Function fread does not terminate string *buf. [Note: The source code implementation of the function has been overridden by a builtin model.]

Cc: Tycho Andersen <tycho.andersen@canonical.com>
sk-inet: don't leak sockets

CID 73347 (#7-4 of 7): Resource leak (RESOURCE_LEAK)
21. leaked_handle: Handle variable sk going out of scope leaks the handle.