jenkins: permit mapped-root helper access to child UID maps

services/jenkins/lesavka-userns-probe.yaml

@@ -13,7 +13,7 @@ data:
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: lesavka-userns-probe-3
+  name: lesavka-userns-probe-4
   namespace: jenkins
 spec:
   backoffLimit: 0
@@ -54,7 +54,8 @@ spec:
             readOnlyRootFilesystem: true
             capabilities:
               drop: ["ALL"]
-              add: ["SETUID", "SETGID"]
+              # newuidmap opens a uid_map owned by the unprivileged child.
+              add: ["SETUID", "SETGID", "DAC_OVERRIDE"]
           resources:
             requests: {cpu: 10m, memory: 32Mi}
             limits: {cpu: 100m, memory: 128Mi, ephemeral-storage: 32Mi}