libcontainer: Don't use UsetCloseOnExec, it is racy

We can't keep file descriptors without close-on-exec except with
syscall.ForkLock held, as otherwise they could leak by accident into
other children from forks in other threads.

Instead we just use Cmd.ExtraFiles which handles all this for us.

This fixes https://github.com/dotcloud/docker/issues/4493

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
Merge pull request #4498 from alexlarsson/fix-cloexec-race

libcontainer: Don't use UsetCloseOnExec, it is racy
remove dbus from apparmor profile

This removes the dbus entry from the apparmor profile Docker creates.

Docker-DCO-1.1-Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com> (github: unclejack)
Create a -G option that specifies the group which unix sockets belong to.

Docker-DCO-1.1-Signed-off-by: Evan Krall <krall@yelp.com> (github: EvanKrall)
Merge pull request #4503 from unclejack/attempt_to_fix_apparmor_profile

remove dbus from apparmor profile for Ubuntu 12.04
Merge pull request #3612 from EvanKrall/specify_socket_group

Create a -G option that specifies the group which unix sockets belong to...