Add PR_{GET,SET}_NO_NEW_PRIVS to prevent execve from granting privs

With this set, a lot of dangerous operations (chroot, unshare, etc)
become a lot less dangerous because there is no possibility of
subverting privileged binaries.

This patch completely breaks apparmor.  Someone who understands (and
uses) apparmor should fix it or at least give me a hint.

Signed-off-by: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: Dan Trifan <jimsth@gmail.com>

Conflicts:
	kernel/sys.c

Signed-off-by: Dan Trifan <jimsth@gmail.com>
Allow unprivileged chroot when safe

Chroot can easily be used to subvert setuid programs.  If no_new_privs,
then setuid programs don't gain any privilege, so allow chroot.

Because chroot is an easy way to break out of chroot jail, CAP_SYS_ADMIN
is still required if the caller is already chrooted.

Signed-off-by: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: Dan Trifan <jimsth@gmail.com>
fs/dcache: boost wake VFS_CACHE_PRESSURE to 120 for better restults with zcache

Signed-off-by: Dan Trifan <jimsth@gmail.com>
atomic: use <linux/atomic.h>

This allows us to move duplicated code in <asm/atomic.h>
(atomic_inc_not_zero() for now) to <linux/atomic.h>

Signed-off-by: Arun Sharma <asharma@fb.com>
Reviewed-by: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: David Miller <davem@davemloft.net>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Acked-by: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Conflicts:
	arch/x86/include/asm/spinlock.h
	drivers/connector/cn_proc.c
	include/linux/netdevice.h
	include/net/cipso_ipv4.h
	lib/crc32.c

Change-Id: Ib17a406a8a65b296ac2bc1f14b7445df9e7ad590
Allow CPU Based Alignment Handling

Conflicts:
	arch/arm/configs/tuna-tw180_defconfig
	arch/arm/configs/tuna180_defconfig
drivers:char: add FRANDOM
Enable cgroup timer slack