Change /dev to be mounted by default with /noexec
Change /dev to be mounted by default with /noexec

Podman had an issue, where someone was attemptig to mount all tmpfs
within the container as noexec. They were able to get most of it done
but "/dev", because it was done down in the runtime spec.

I can think of no reason why "/dev", should not be mounted with noexec
especially within a container.  I know it is not mounted by default in
Fedora that way, but I do not know why.

Debian looks like it has made the change, and only one bug a couple of
years ago showed issues, which would not apply to containers.

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=940171

Anyways this would make containers "slightly" more secure, and I think it
is worth doing.

Signed-off-by: Daniel J Walsh <7800de746fd39599bc46177380ea6aede7e31e16@redhat.com>

opencontainers/runtime-tools,opencontainers/runtime-tools