loop back mounting emits two system calls: mount and mlockall.
mount is obviously needed. mlockall is needed for encryption.
As the result both CAP_SYS_ADMIN and CAP_IPC_LOCK are needed
to do loopback mounting.
The problem is that CAP_IPC_LOCK is always needed through my
command doesn't need encryption.
With the following patch, mount calls mlockall only when
encryption is needed.