userns: close all file descriptors before entering into userns

Cc: Jann Horn <jann@thejh.net>
Reporte-by: Jann Horn <jann@thejh.net>
Signed-off-by: Andrew Vagin <avagin@virtuozzo.com>
Signed-off-by: Pavel Emelyanov <xemul@virtuozzo.com>

criu/namespaces.c

@@ -654,6 +654,7 @@ static int check_user_ns(int pid)
 		struct __user_cap_header_struct hdr;
 		uid_t uid;
 		gid_t gid;
+		int i;
 
 		uid = host_uid(0);
 		gid = host_gid(0);
@@ -696,6 +697,10 @@ static int check_user_ns(int pid)
 			return -1;
 		}
 
+		close_old_fds();
+		for (i = SERVICE_FD_MIN + 1; i < SERVICE_FD_MAX; i++)
+			close_service_fd(i);
+
 		/*
 		 * Check that we are able to enter into other namespaces
 		 * from the target userns namespace. This signs that these