Add fakeroot - combined mount and chroot to create a docker-like view on the filesystem

[MarkusBauer]

While this project already has support for chroot and pivot_root, these features are hardly useful if you want to start anything else than a static linked binary. Thus I added a more powerful feature: fakeroots.

A fakeroot is an initially empty root, where directories from the host can be selectively shared. Shares can be read-only if necessary, providing additional isolation. For example, this code allows read-only access to installed programs but not user data and no write access at all:

cmd.fakeroot_enable("/dev/shm/sandbox_root");
cmd.fakeroot_mount("/bin", "/bin", true);
cmd.fakeroot_mount("/etc", "/etc", true);
cmd.fakeroot_mount("/lib", "/lib", true);
cmd.fakeroot_mount("/lib64", "/lib64", true);
cmd.fakeroot_filesystem("proc", "/proc");
cmd.fakeroot_filesystem("tmpfs", "/tmp");
cmd.fakeroot_mount("/usr", "/usr", true);

The implementation is mostly inspired by nsjail which uses the same syscall sequence.
The featureset is very basic - only host directories can be shared (read-only or readwrite), and a /proc and /tmp are available on demand. Follow-up features could include sharing files/devices or mounting to subdirectories.

---

Availability: If anyone wants to use this and other features before it's merged, check out my temporary fork. It includes #23 #27 #29 #33 #34 #35 and #36 with all conflicts resolved.
Add to your Cargo.toml: unshare = { git = "https://github.com/MarkusBauer/unshare.git" }