[patch v3] Allow for unpriviledged nested containers

[Florian Weimer]

* DJ Delorie:

> Florian Weimer <fweimer@redhat.com> writes:
>>> Well, for the pldd test, obviously we do ;-)
>>
>> Do we?  /proc and the PIDs of the processes have to be consistent for
>> sure, but do we really need them to be separate from the host?
>
> It's the consistency that's the problem.  If getpid() (which returns a
> pid in the child namespace) returns a value that's useless in
> /proc/<pid> (because those are pids in the parent namespace) then the
> test fails.
>
> One process can have different PIDs depending on how you look at it.

Then elf/tst-pldd should be fine with 4.

>>> 1. No /proc
>>> 2. /proc in wrong namespace
>>> 3. /proc in correct namespace
>>>
>>> We'd prefer 3, then 1, but not 2?
>>
>> Yeah, 2 is quite bad for some tests at least.  Some thread-exit tests
>> will suffer as well, I think, because they read TIDs from
>> /proc/self/task.
>
> 3-then-1 returns us to my original patch, which attempted to mount it in
> the child namespace, or failed but let the test run anyway.

Sorry, I missed that there is no 3b:

3b. /proc in correct namespace (but host PID namespace)

So instead:

  /* The unshare here gives us our own spaces and capabilities.  */
  if (unshare (CLONE_NEWUSER | CLONE_NEWPID | CLONE_NEWNS) < 0)

This:

  /* The unshare here gives us our own spaces and capabilities.  */
  if (unshare (CLONE_NEWUSER | CLONE_NEWNS) < 0)

Not sure if it will work.  CLONE_NEWPID is preferable for better test
isolation, but maybe it's still better to run tests with reduced
isolation.  I think our main goal is the unprivileged chroot, followed
by avoiding Netfilter connection tracking table overflow.

Thanks,
Florian