Remount several proc filesystem entries as read-only.
Remount several proc filesystem entries as read-only.

Several entries under the proc FS within Mesos containers need to be
remounted as readonly for improved security reasons.

The list should include the important ones introduced by Systemd's
`ProtectKernelTunables` option:

* `/proc/bus`
* `/proc/fs`
* `/proc/irq`
* `/proc/sys`
* `/proc/sysrq-trigger`

It is particularly necessary to remount `/proc/sysrq-trigger` as
read-only. Otherwise, it would be possible for processes running in
containers as `root` to perform privileged operations, such as host
reboot.

Extra mount options should include `nosuid,noexec,nodev` (see also
`mount(2)` for detailed explanations of the options).

Review: https://reviews.apache.org/r/66034/

kaysoky/mesos,chhsia0/mesos,andschwa/mesos,reneploetz/mesos,reneploetz/mesos,Gilbert88/mesos,chhsia0/mesos,gsantovena/mesos,gsantovena/mesos,chhsia0/mesos,asamerh4/mesos,gsantovena/mesos,kaysoky/mesos,jpeach/mesos,gsantovena/mesos,reneploetz/mesos,kaysoky/mesos,dforsyth/mesos,abudnik/mesos,abudnik/mesos,asamerh4/mesos,kaysoky/mesos,jpeach/mesos,Gilbert88/mesos,dforsyth/mesos,andschwa/mesos,abudnik/mesos,asamerh4/mesos,gsantovena/mesos,andschwa/mesos,Gilbert88/mesos,kaysoky/mesos,chhsia0/mesos,asamerh4/mesos,dforsyth/mesos,dforsyth/mesos,reneploetz/mesos,andschwa/mesos,Gilbert88/mesos,jpeach/mesos,kaysoky/mesos,asamerh4/mesos,kaysoky/mesos,andschwa/mesos,abudnik/mesos,gsantovena/mesos,chhsia0/mesos,reneploetz/mesos,jpeach/mesos,abudnik/mesos,dforsyth/mesos,abudnik/mesos,jpeach/mesos,jpeach/mesos,asamerh4/mesos,abudnik/mesos,dforsyth/mesos,chhsia0/mesos,reneploetz/mesos,jpeach/mesos,asamerh4/mesos,chhsia0/mesos,Gilbert88/mesos,Gilbert88/mesos,andschwa/mesos,andschwa/mesos,Gilbert88/mesos,gsantovena/mesos,reneploetz/mesos,dforsyth/mesos