From 428083683e749aeb40a4fd2fd28a1172fb1e9bf7 Mon Sep 17 00:00:00 2001
From: jenkins <brad@bstein.dev>
Date: Sun, 8 Nov 2026 17:05:56 -0600
Subject: [PATCH] jenkins: permit mapped-root helper access to child UID maps

---
 services/jenkins/lesavka-userns-probe.yaml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/services/jenkins/lesavka-userns-probe.yaml b/services/jenkins/lesavka-userns-probe.yaml
index ed8e78cb..38438c80 100644
--- a/services/jenkins/lesavka-userns-probe.yaml
+++ b/services/jenkins/lesavka-userns-probe.yaml
@@ -13,7 +13,7 @@ data:
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: lesavka-userns-probe-3
+  name: lesavka-userns-probe-4
   namespace: jenkins
 spec:
   backoffLimit: 0
@@ -54,7 +54,8 @@ spec:
             readOnlyRootFilesystem: true
             capabilities:
               drop: ["ALL"]
-              add: ["SETUID", "SETGID"]
+              # newuidmap opens a uid_map owned by the unprivileged child.
+              add: ["SETUID", "SETGID", "DAC_OVERRIDE"]
           resources:
             requests: {cpu: 10m, memory: 32Mi}
             limits: {cpu: 100m, memory: 128Mi, ephemeral-storage: 32Mi}