Cannot update devices cgroups when already in a user namespace

Therefore check for that.  This is a step to being able to run
docker/runc containers inside a user namespaced container.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

libcontainer/cgroups/fs/devices.go

@@ -3,6 +3,7 @@
 package fs
 
 import (
+	"github.com/lxc/lxd/shared"
 	"github.com/opencontainers/runc/libcontainer/cgroups"
 	"github.com/opencontainers/runc/libcontainer/configs"
 )
@@ -15,6 +16,9 @@ func (s *DevicesGroup) Name() string {
 }
 
 func (s *DevicesGroup) Apply(d *cgroupData) error {
+	if shared.RunningInUserNS() {
+		return nil
+	}
 	dir, err := d.join("devices")
 	if err != nil {
 		// We will return error even it's `not found` error, devices
@@ -30,6 +34,9 @@ func (s *DevicesGroup) Apply(d *cgroupData) error {
 }
 
 func (s *DevicesGroup) Set(path string, cgroup *configs.Cgroup) error {
+	if shared.RunningInUserNS() {
+		return nil
+	}
 	if !cgroup.Resources.AllowAllDevices {
 		if err := writeFile(path, "devices.deny", "a"); err != nil {
 			return err