With this patch, I can start a container 'o1' inside another container 'o1'.
(Of course, the containers must be on a different subnet)

Detail:

1. Create cgroups for containers under /lxc.

2. Support nested lxc: respect init's cgroup:

Create cgroups under init's cgroup.  So if we start a container c2
inside a container 'c1', we'll use /sys/fs/cgroup/freezer/lxc/c1/lxc/c2
instead of /sys/fs/cgroup/freezer/c2.  This allows a container c1
to be created inside container c1  It also allow a container's limits
to be enforced on all a container's children (which a MAC policy could
already enforce, in which case current lxc code would be unable to nest
altogether).

3. Finally, if a container's cgroup already exists, rename it rather than
failing to start the container.  Try to WARN the user so they might go
clean the old cgroup up.

Whereas without this patch, container o1's cgroup would be
	/sys/fs/cgroup/<subsys>/o1,
it now becomes
	/sys/fs/cgroup/<subsys>/<initcgroup>/lxc/o1
so if init is in cgroup '/' then o1's freezer cgroup would be:
	/sys/fs/cgroup/freezer/lxc/o1

Changelog:
	. make lxc-ps work with separate mtab.  If cgroups were mounted with -n,
	  and mtab is not linked to /proc/self/mounts, then 'mount -t cgroup' won't
	  show these mounts.  So make lxc-ps not use it, but rather use
	  /proc/self/mounts directly.
	. lxc-ls in the past assumed that a container's cgroup was just '/<name>'.
	  Now it is '/<host-init-cgroup>/lxc/<name>'.  Handle that.
	. first version of this patch was setting clone_children on
	  <path-to-cpusets-cgroup>/<init-cgroup>/lxc, not the parent of that dir.
	  That failed to initialize that cgroup, so tasks could not enter it.
Signed-off-by: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>