jenkins: qualify nested PID and proc namespaces

services/jenkins/lesavka-userns-probe.yaml

@@ -13,7 +13,7 @@ data:
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: lesavka-userns-probe-6
+  name: lesavka-userns-probe-7
   namespace: jenkins
 spec:
   backoffLimit: 0
@@ -83,6 +83,8 @@ spec:
             # File capabilities keep the helper's effective UID equal to the
             # target namespace owner. No SYS_ADMIN or host identity is granted.
             allowPrivilegeEscalation: true
+            # Only the mapped pod's procfs; host PID/network remain separate.
+            procMount: Unmasked
             readOnlyRootFilesystem: true
             capabilities:
               drop: ["ALL"]
@@ -119,8 +121,13 @@ spec:
                   'import os; os.setgroups([]); os.setgid(1001); os.setuid(1001); '
                   'assert os.geteuid() == 1001 and os.getegid() == 1001'],
                   check=True, timeout=10)
+              subprocess.run(['unshare', '--user', '--map-root-user', '--mount',
+                  '--pid', '--net', '--fork', '--kill-child=KILL',
+                  '--propagation', 'private', '--mount-proc', '/bin/true'],
+                  check=True, timeout=10)
               print(json.dumps({'pod_user_namespace': 'pass', 'maps': maps,
                     'nested_mapping_private_mount': 'pass',
+                    'private_pid_network_proc': 'pass',
                     'scope': 'namespace prerequisites only; full suite unqualified'}))
       volumes:
         - name: mapping-tools