clone_private_mount() doesn't need to touch namespace_sem