cgroup2: devices: handle eBPF skipping more correctly
cgroup2: devices: handle eBPF skipping more correctly

In the past we incorrectly handled eBPF errors in two ways:

 1. We would only ignore errors if there was an allow rule in the list
    (this doesn't make sense because for security purposes we only care
    if a *deny* rule is being ignored). Arguably this is a security flaw
    but you would only get an error from bpf(2) in rare cases, and thus
    is not a big enough deal to go through security review.

 2. If we were in a rootless container we would still return an error
    even though bpf(2) is blocked for rootless containers.

Signed-off-by: Aleksa Sarai <b305c9b0212d6145eea67bbffd24e29cb79c759c@cyphar.com>

rhatdan/runc,estesp/runc,rhatdan/runc,dqminh/runc,opencontainers/runc,rhatdan/runc,dqminh/runc,opencontainers/runc,kolyshkin/runc,kolyshkin/runc,estesp/runc,opencontainers/runc,kolyshkin/runc,rhatdan/runc,dqminh/runc,estesp/runc,kolyshkin/runc,opencontainers/runc,dqminh/runc