Added revised version of the no-new-privs post.

[jberkus]

This is the revised version of @mrunalp 's post about no-new-privileges. It is not ready to go yet. There's a number of questions:

• @mrunalp, I had to revise the post significantly, please verify that I didn't add any errors
• @mrunalp it's your patch to Docker, no? Shouldn't we credit you by name? Who else worked on it?
• @rhatdan, @jlebon, @jasonbrooks please check sample code, thanks!

[mrunalp]

Metadata doesn't look right.

[mrunalp]

@jberkus Yes, I worked on the patches to OCI spec, runc and docker. @rhatdan helped with the selinux policy changes required for it.

[rhatdan]

Change the Red Hat staff ... Intro to I.

Red Hat staff working on Project Atomic have contributed support for a `no-new-privileges`

I have contributed support for `no-new-privileges` ...

Then add a paragraph:

Turning on no_new_privs actually stopped the SELinux transition from the docker daemon type docker_t to the container type, svirt_lxc_net_t. no_new_privs only allows SELinux transitions from one type to another iff the target type as a complete subset of the source type. Dan Walsh worked on the
SELinux policy for docker to fix this. With the latest policy in Fedora 24, no_new_privs and SELinux work well together. We will be back porting these fixes to RHEL when we ship docker support for no_new_privs.

[jberkus]

OK, updated with changes. @bproffitt, this should be ready to go unless Dan or Mrunal object.

[jberkus]

Crap, closed this by accident. @bproffitt, if you can publish this tommorrow?