
The worst-case scenario in terms of enforcing --disable-userns is that we're retaining all capabilities, so test that too, to make sure that the option is genuinely restricting even a privileged user. Signed-off-by: Simon McVittie <smcv@collabora.com>