rootfs: umount all procfs and sysfs with --no-pivot
rootfs: umount all procfs and sysfs with --no-pivot

When creating a new user namespace, the kernel doesn't allow to mount
a new procfs or sysfs file system if there is not already one instance
fully visible in the current mount namespace.

When using --no-pivot we were effectively inhibiting this protection
from the kernel, as /proc and /sys from the host are still present in
the container mount namespace.

A container without full access to /proc could then create a new user
namespace, and from there able to mount a fully visible /proc, bypassing
the limitations in the container.

A simple reproducer for this issue is:

unshare -mrfp sh -c "mount -t proc none /proc && echo c > /proc/sysrq-trigger"

Signed-off-by: Giuseppe Scrivano <20002b7b24c75512093a71a58285826d5c504fca@redhat.com>

rhatdan/runc,mheon/runc,kolyshkin/runc,estesp/runc,estesp/runc,rhatdan/runc,justincormack/runc,crosbymichael/runc,adrianreber/runc,opencontainers/runc,mikebrow/runc,xiaochenshen/runc,mYmNeo/runc,rhatdan/runc,estesp/runc,justincormack/runc,dqminh/runc,dqminh/runc,adrianreber/runc,opencontainers/runc,xiaochenshen/runc,xiaochenshen/runc,kolyshkin/runc,crosbymichael/runc,dqminh/runc,justincormack/runc,kolyshkin/runc,rhatdan/runc,opencontainers/runc,opencontainers/runc,mYmNeo/runc,mheon/runc,mheon/runc,mikebrow/runc,mYmNeo/runc,adrianreber/runc,crosbymichael/runc,mikebrow/runc,dqminh/runc,kolyshkin/runc