Merge "Keep /mnt/secure private to default namespace." into jb-mr1-dev

    # Directory for putting things only root should see.

    mkdir /mnt/secure 0700 root root

    # Create private mountpoint so we can MS_MOVE from staging

    mount tmpfs tmpfs /mnt/secure mode=0700,uid=0,gid=0

    # Directory for staging bindmounts

    mkdir /mnt/secure/staging 0700 root root

    mount rootfs rootfs / ro remount

    # mount shared so changes propagate into child namespaces

    mount rootfs rootfs / shared rec

    mount tmpfs tmpfs /mnt/secure private rec

    # We chown/chmod /cache again so because mount is run as root + defaults

    chown system cache /cache