Cherry-picked from upstream. Also applied a fix for the CPUShares configuration option while I'm at it. CVE-2013-4327