Bring `/dev/pts` isolation back

[KellerFuchs]

I had to back it out because it was causing issues: separate user sessions where getting separate /dev/pts instances, breaking tmux (amongst others).
Also, this broke write(1), but that's more by design.

Do we want the devpts isolation back, and how do we go about it?

[daurnimator]

Perhaps we just need an entry in namespace.conf?
i.e. /dev/pts /dev/pts-inst/ user root

[KellerFuchs]

I tried that on da1, but didn't go anywhere.

The things we need to test before deploying that again are:

• opening a completely-clean session (i.e. new user, no pre-existing namespace);
• ability to open a second (concurrent) session and attach to tmux created in the first session;
• doing those two things again after all sessions are gone;
• all of the previous when the first session was opened with the current config, to check if terminating user sessions is required (again).

[KellerFuchs]

@hashbang/administrators We will be forced to fix this in the mid-term:
Kernel commit eedf265 lands in 4.7-rc2, will be in Debian Stretch, and makes all devpts mounts be newinstances.

[KellerFuchs]

@hashbang/administrators Of course, now the kernel upgrade (needed to deal with the mount namespace bug) brought us to 4.9 (except da1 and to1), meaning that it's an ongoing issue for many users.

Suggested temp fix: disabling /dev polyinstanciation, rebooting ny1 and sf1 (and scheduling a reboot of da1 and to1 for the kernel upgrade, after it is confirmed working)