cgfsng: mount pure unified cgroup layout correctly

src/lxc/cgroups/cgfsng.c

@@ -1761,8 +1761,8 @@ static inline int cg_mount_cgroup_full(int type, struct hierarchy *h,
 }
 
 __cgfsng_ops static bool cgfsng_mount(struct cgroup_ops *ops,
-					struct lxc_handler *handler,
-					const char *root, int type)
+				      struct lxc_handler *handler,
+				      const char *root, int type)
 {
 	__do_free char *tmpfspath = NULL;
 	int ret;
@@ -1795,8 +1795,23 @@ __cgfsng_ops static bool cgfsng_mount(struct cgroup_ops *ops,
 	else if (type == LXC_AUTO_CGROUP_FULL_NOSPEC)
 		type = LXC_AUTO_CGROUP_FULL_MIXED;
 
-	/* Mount tmpfs */
-	tmpfspath = must_make_path(root, "/sys/fs/cgroup", NULL);
+	if (ops->cgroup_layout == CGROUP_LAYOUT_UNIFIED) {
+		__do_free char *unified_path = NULL;
+
+		unified_path = must_make_path(root, "/sys/fs/cgroup", NULL);
+		if (has_cgns && wants_force_mount) {
+			/* If cgroup namespaces are supported but the container
+			 * will not have CAP_SYS_ADMIN after it has started we
+			 * need to mount the cgroups manually.
+			 */
+			return cg_mount_in_cgroup_namespace(type, ops->unified,
+							    unified_path) == 0;
+		}
+
+		return cg_mount_cgroup_full(type, ops->unified, unified_path) == 0;
+	}
+
+	/* mount tmpfs */
 	ret = safe_mount(NULL, tmpfspath, "tmpfs",
 			 MS_NOSUID | MS_NODEV | MS_NOEXEC | MS_RELATIME,
 			 "size=10240k,mode=755", root);