rootfs: handle nested procfs mounts for MS_MOVE
rootfs: handle nested procfs mounts for MS_MOVE

In a case where the host /proc mount has already been overmounted, the
MS_MOVE handling would get ENOENT when trying to hide (for instance)
"/proc/bus" because it had already hidden away "/proc". This revealed
two issues in the previous implementation of this hardening feaure:

1. No checks were done to make sure the mount was a "full" mount (it is
   a mount of the root of the filesystem), but the kernel doesn't permit
   a non-full mount to be converted to a full mount (for reference, see
   mnt_already_visible). This just removes extra busy-work during setup.

2. ENOENT was treated as a critical error, even though it actually
   indicates the mount doesn't exist and thus isn't a problem. A more
   theoretically pure solution would be to store the set of mountpoints
   to be hidden and only ignore the error if an ancestor directory of
   the current mountpoint was already hidden, but that would just add
   complexity with little justification.

In addition, better document the reasoning behind this logic so that
folks aren't confused when looking at it.

Fixes: 28a697cce3e4 ("rootfs: umount all procfs and sysfs with --no-pivot")
Signed-off-by: Aleksa Sarai <b305c9b0212d6145eea67bbffd24e29cb79c759c@cyphar.com>

kolyshkin/runc,estesp/runc,opencontainers/runc,dqminh/runc,rhatdan/runc,xiaochenshen/runc,kolyshkin/runc,dqminh/runc,kolyshkin/runc,estesp/runc,dqminh/runc,estesp/runc,xiaochenshen/runc,kolyshkin/runc,rhatdan/runc,dqminh/runc,xiaochenshen/runc,opencontainers/runc,opencontainers/runc,rhatdan/runc,rhatdan/runc,opencontainers/runc