Devices Namespace

Rationale:

Devices in linux currently exist in a single namespace. A (type:major:minor)
refers to the same device for every process. More importantly, requests for
uevents from the kernel are sent for all devices to all listeners. When a
container does udevadm trigger --action=add, add uevents for all hardware are
resent to the host and all other listeners (containers).

Currently the devices namespace can be used to restrict access from containers
to (type:major:minor). If apparmor is given the ability to filter netlink
traffic, containers could be prevented from doing udevadm trigger.

Ideally we would be able to create a new mapping from (type:major:minor) to
kernel devices for containers. When in a new private mapping (== namespace),
udevadm trigger would be restricted to mapped devices. Some devices such
as /dev/null and /dev/zero could be shared among mappings. Others, such
as /dev/loop* may want more flexible mappings. When combined with the
user namespace, this would mean that whereas b 7:0 would be /dev/loop0 on
the host, the container could have b 7:0 point to a different loop device,
owned by his own user namespace and perhaps mapped to a different
(type:major:minor) on the host (or not mapped there at all).

The work in this cycle is to come up with a design for devices namespaces.