nspawn: Be more robust when deciding to create subcgroups or chown cgroups

To demonstrate the breakage in the chown part: Be using an interactive
terminal, go to spawn a shell in a container; using --register=no, and using
userns.  It will end up chown()ing the cgroup of your terminal session to the
container!  And you will be left with that after you quit the container!

Similarly. the subcgroup bit will try create subcgroups for the parent and
child even they share the cgroup with other processes (as they likely to if
--register=no); and will find only partial success, leaving the cgroup with all
controllers disabled.

What we really care about is if the child process is alone in the cgroup, so
we'll take a peek at cgroup.procs for that cgroup to find out.

0 files changed, 0 insertions, 0 deletions