unshare: reexec using a memfd copy instead of the binary
unshare: reexec using a memfd copy instead of the binary

When we're unshare()ing, copy /proc/self/exe into a memory FD before
exec()ing it, so that the descriptor which we leak into our child
process's namespace through the /proc/$parent/exe link is one that gets
discarded after the process exits, and seal it against modifications as
soon as we're finished populating it, mimicking patches for other
projects that mitigate CVE-2019-5736.

Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>

Closes: #1334
Approved by: giuseppe

projectatomic/buildah,TomSweeneyRedHat/buildah,rhatdan/buildah,TomSweeneyRedHat/buildah,nalind/buildah-1,nalind/buildah,rhatdan/buildah,nalind/buildah-1,nalind/buildah-1,TomSweeneyRedHat/buildah,rhatdan/buildah,projectatomic/buildah,projectatomic/buildah,nalind/buildah