cgproxy: remove proxydir if it exists

If /sys/fs/cgroup/cgmanager is not a mount that we can move, then
we need to rename it.  But if /sys/fs/cgroup/cgmanager.lower
already exists, then we have to remove that before we can
mv /sys/fs/cgroup/cgmanager to it.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
rmdir rather than unlink the directory

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
README: think through special cases

think through special cases for older kernels.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Update cross-namespace behavior

As per the newly added section to README:

If we are on an older kernel, the only calls we want to reject are
MovePidAbs.  The others will confuse the caller, but not compromise
the host.

On newer kernels we do want to avoid calls which can only confuse
the caller, so require a proxy for those.  There is no good case for
allowing those calls.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
move_pid: stick to what the README says

If the kernel does not support /proc/pid/ns/pid, then don't
require an scm call.  Rather, require that the target pid be
in a child cgroup of the proxy.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
cgmanager_chown_main: don't fail for root on old kernel

If our kernel doesn't do user namespaces, still allow root
to chown.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
test19: give the test something to escape from

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
test19: final cg may not be original

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
configure: tag 0.20

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
add a configurable maximum cgroup depth

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
implement list_children

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
fix mode on test20.sh

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>