restore: close_old_fds after restoring namespaces

Restore of netns uses the file descriptor on the root netns. This
descriptor is opened before forking.
We can add one more service fd, but I think this approach is better.
Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>

cr-restore.c

@@ -998,12 +998,8 @@ static int restore_task_with_children(void *_arg)
 
 	current = ca->item;
 
-	if ( !(ca->clone_flags & CLONE_FILES)) {
+	if ( !(ca->clone_flags & CLONE_FILES))
 		close_safe(&ca->fd);
-		ret = close_old_fds(current);
-		if (ret)
-			exit(1);
-	}
 
 	if (current->state != TASK_HELPER) {
 		ret = clone_service_fd(current->rst->service_fd_id);
@@ -1057,6 +1053,12 @@ static int restore_task_with_children(void *_arg)
 	if (read_vmas(pid))
 		exit(1);
 
+	if ( !(ca->clone_flags & CLONE_FILES)) {
+		ret = close_old_fds(current);
+		if (ret)
+			exit(1);
+	}
+
 	pr_info("Restoring children:\n");
 	list_for_each_entry(child, &current->children, sibling) {
 		if (!restore_before_setsid(child))