attach: use PR_SET_NO_NEW_PRIVS
attach: use PR_SET_NO_NEW_PRIVS

- When we detect that the container, we want to attach to, has been stared with
  PR_SET_NO_NEW_PRIVS we attach with PR_SET_NO_NEW_PRIVS as well. (We might
  relax this restriction later but let's be strict for now.)
- When LXC_ATTACH_NO_NEW_PRIVS is set in the flags passed to
  lxc_attach()/attach_child_main() then we set PR_SET_NO_NEW_PRIVS irrespective
  of whether the container was started with PR_SET_NO_NEW_PRIVS or not.
- Set no_new_privs before lsm and seccomp. We probably don't want attach() to
  be able to change the lsm or seccomp policy if the container was started with
  PR_SET_NO_NEW_PRIVS enabled.

Signed-off-by: Christian Brauner <48455ab3070520a2d174545c7239d6d0fabd9a83@canonical.com>

caglar10ur/lxc,ysbnim/lxc,terceiro/lxc,ss1h2a3tw/lxc,ysbnim/lxc,federicobriata/lxc,hfuCN/lxc,thmo/lxc,LynxChaus/lxc,aeris/lxc,caglar10ur/lxc,thmo/lxc,hfuCN/lxc,caglar10ur/lxc,hfuCN/lxc,ysbnim/lxc,cjwatson/lxc,LynxChaus/lxc,GreatFruitOmsk/lxc,cjwatson/lxc,terceiro/lxc,federicobriata/lxc,GreatFruitOmsk/lxc,hallyn/lxc,thmo/lxc,cjwatson/lxc,aeris/lxc,hallyn/lxc,LynxChaus/lxc,ss1h2a3tw/lxc,federicobriata/lxc,aeris/lxc,terceiro/lxc,GreatFruitOmsk/lxc,ss1h2a3tw/lxc,hallyn/lxc