mount: bind-mount root into itself if processes are restored in userns

When we create a new mntns in a userns, all inhereted mounts are marked
as locked. pivot_root() returns EINVAL if a new root is locked.
userns: define protobuf messages for uid and gid maps

Normally, one of the first steps after creating a new user namespace is
to define the mappings used for the user and group IDs of the processes
that will be created in that namespace. This is done by writing mapping
information to the /proc/PID/uid_map and /proc/PID/gid_map files
corresponding to one of the processes in the user namespace.
criu: add constants about user namespaces
dump: get tasks ids from parasite

We have two reason for that:
* parsing of /proc/pid/status is slow
* parasite returns ids from a target userns
dump: remove useless arguments from seize_task()

We get sig and pgid from a parasite, because we need to get
them from a target pid namespace.
proc: parse state and ppid from /proc/pid/status
dump: move the may_dump() check in seize_task()

It's a bad idea to a group of processes and only then check
rights for this operation. We need to check permissions a soon as
posible to reduce impacts in case of wrong permissions.

In addtion criu doesn't to parse /proc/pid/state and gets all required
infromation from /proc/pid/status.
proc: delete parse_pid_stat_small()

It's unused now.
userns: save uid-s from a target userns (v2)

We are going to support user namespaces and uid-s will be converted
accoding with userns mappings.

v2: conver id-s for sockets too
dump: dump user namespaces

For that we need to save per-namespace mappings of user and group IDs.

And all id-s for tasks and files are saved from the target user
namespace.
userns: restore per-namespace mappings of user and group IDs (v2)

In this patch we fill /proc/PID/uid_map and /proc/PID/gid_map for the
root task.

v2: initialize groups in a new namespace.
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

v3: add a helper to initialize creds in a new userns
restore:  set PR_SET_DUMPABLE to have access to proc files

It is cleared when a process is forked in a new userns.
zdtm: create devices before forking a test process

Devices can not be created in a new user namespace.
zdtm: prepare a file tree for userns

Here are two issues:
1. All mounts in a new user namespace are locked, so
we need to create a new root mount. We need to bind-mount root to
itself.
2. /proc and /sys must be mounted before umounting /proc and /sys
which were inhereted. It's a security policy.

"""
Author: Eric W. Biederman <ebiederm@xmission.com>
Date:   Sun Mar 24 14:28:27 2013 -0700

    userns: Restrict when proc and sysfs can be mounted

    Only allow unprivileged mounts of proc and sysfs if they are already
    mounted when the user namespace is created.
"""
zdtm: add ability to execute tests in another user namespace

v2: don't forget to initialize groups
zdtm: add tests which can be executed in a new user namespace (v2)

Sockets tests are excluded, because SO_RCVBUFFORCE and SO_SNDBUFFORCE
are protected by CAP_NET_ADMIN

tty*, pty* are excluded, because TIOCSLCKTRMIOS protected by
CAP_SYS_ADMIN

*ghost, *notify, *unlink* are excluded, because linkat(AT_EMPTY_PATH)
are protected by CAP_DAC_READ_SEARCH

v2: use a blacklist
userns: check that all namespaces were created from a target userns

We enter into the target userns and try to enter in other namespaces.
The "enter" operation requires CAP_SYS_ADMIN in a user namespace,
where a taget namespace was created.

Now if one or more namespaces were created in another userns,
criu stops dumping and return an error. I want to find someone, who uses
this configuration. In this case restore will be more complicated.
Current version covers containers needs.
flock: blocked processes are not interesting for us

All out processes are stopped in a moment, when file locks are
collected, so they can't to wait any locks.

Here is a proof of this theory:
[root@avagin-fc19-cr ~]# flock xxx sleep 1000 &
[1] 23278
[root@avagin-fc19-cr ~]# flock xxx sleep 1000 &
[2] 23280
[root@avagin-fc19-cr ~]# cat /proc/locks
1: FLOCK  ADVISORY  WRITE 23278 08:03:280001 0 EOF
1: -> FLOCK  ADVISORY  WRITE 23280 08:03:280001 0 EOF
[root@avagin-fc19-cr ~]# gdb -p 23280
(gdb) ^Z
[3]+  Stopped                 gdb -p 23280
[root@avagin-fc19-cr ~]# cat /proc/locks
1: FLOCK  ADVISORY  WRITE 23278 08:03:280001 0 EOF

Currently criu can dump nothing, if we have one process which is
waiting a lock. I don't see any reason to do this.

Cc: Qiang Huang <h.huangqiang@huawei.com>
Reported-by: Mr Jenkins
coverity
sysfs: fix use_after_free issue

CID 73379 (#1 of 1): Use after free (USE_AFTER_FREE)
31. deref_arg: Calling fclose dereferences freed pointer fp.