libcontainer: default mount propagation correctly

[euank]

The code in prepareRoot (

runc/libcontainer/rootfs_linux.go

Lines 599 to 605 in e385f67

	flag := unix.MS_SLAVE | unix.MS_REC
	if config.RootPropagation != 0 {
	flag = config.RootPropagation
	}
	if err := unix.Mount("", "/", "", uintptr(flag), ""); err != nil {
	return err
	}

)
attempts to default the rootfs mount to rslave. However, since the spec
conversion has already defaulted it to rprivate, that code doesn't
actually ever do anything.

This changes the spec conversion code to accept "" and treat it as 0.

Implicitly, this makes rootfs propagation default to rslave, which is
a part of fixing the moby bug moby/moby#34672

Alternate implementatoins include changing this defaulting to be
rslave and removing the defaulting code in prepareRoot, or skipping
the mapping entirely for "", but I think this change is the cleanest of
those options.

cc @cyphar, this is somewhat similar to #1500 and fixes a similar problem.

[cyphar]

#1500 fixes a related but not identical race that you can hit with devicemapper.

LGTM, but there are bigger problems than just this piece of code. These issues are caused by an architectural issue with containerd (which came from Docker's design). The solution should be to make containerd spawn each runc in a separate mount namespace (with the rootfs mounts done inside the namespace) which will avoid leakage into other containers. Of course, this is not really possible at the moment due to the way the Docker/containerd split were set up.

[hqhq]

LGTM