libct/cg/sd: fix SkipDevices for systemd

[kolyshkin]

1. libct/cg/sd: fix SkipDevices for systemd

   Commit 108ee85 (PR libct/cgroups: add SkipDevices to Resources #2490) adds SkipDevices flag, which is used by kubernetes
   to create cgroups for pods.

   Unfortunately the above commit falls short, and systemd DevicePolicy and
   DeviceAllow properties are still set, which requires kubernetes to set
   "allow everything" rule.

   This commit fixes this: if SkipDevices flag is set, we return
   Device* properties to allow all devices.

2. libct/cg/sd: add SkipDevices unit test

   The idea is to mimic what kubelet is doing, with minimum amount of code.

   First, create a slice with SkipDevices=true. It should have access to
   all devices.

   Next, create a scope within the above slice, allowing access to /dev/full
   only.

   Check that within that scope we can only access /dev/full and not other
   devices (such as /dev/null).

   Repeat the test with SkipDevices=false, make sure we can not access any
   devices (as they are disallowed by a parent cgroup). This is done only
   to assess the test correctness.

   NOTE that cgroup v1 and v2 behave differently for SkipDevices=false
   case, and thus the check is different. Cgroup v1 returns EPERM on
   writing to devices.allow, so cgroup manager's Set() fails, and we check
   for a particular error from m.Set(). Cgroup v2 allows to create a child
   cgroup, but denies access to any device (despite access being enabled)
   -- so we check the error from the shell script running in that cgroup.
   Again, this is only about SkipDevices=false case.

Previous discussions on topic: #2490 (comment), kubernetes/kubernetes#92862 (comment)

Fixes: 108ee85

[cyphar]

LGTM.

[AkihiroSuda]

Would it be possible to have some tests?

[kolyshkin]

Would it be possible to have some tests?

I started working on something that mimics the kubelet behavior...

[cyphar]

CentOS failure seems legit -- SELinux?

=== RUN   TestSkipDevicesFalse
    systemd_test.go:129: failed to write "c 1:7 rwm": write /sys/fs/cgroup/devices/system.slice/system-runc_test_pods.slice/test-SkipDevices.scope/devices.allow: operation not permitted
--- FAIL: TestSkipDevicesFalse (0.20s)

[cyphar]

Once this is merged I will send out the v1.0.0 vote (it would be nice to do the release -- as @h-vetinari suggested -- on the 3rd of June since that's the 5-year anniversary of 1.0.0-rc1).

[kolyshkin]

Test case fixed, PR description updated.

[cyphar]

LGTM. Will send the v1.0.0 vote out today.