ceamac
b1a2d924e8
Root already has full privilege without a new user namespace. Creating one anyway (bwrap's default single-mapping uid/gid setup, no --uid/--gid/subuid ranges) forces the kernel's unprivileged-userns setgroups() restriction: every supplementary group outside that one mapping collapses to the overflow gid (65534/"nobody"), and setgroups() calls inside the sandbox then fail. Reported by the user running -r images/gitea.tar as root: `id` showed groups=0(root),65534(nobody) repeated once per real supplementary group, and `su git` failed with "can't set groups: Operation not permitted". detect_bwrap_unshare_args() now skips --unshare-user (and stops combining the other probes with CLONE_NEWUSER) whenever geteuid() == 0 -- confirmed fixed by the user on a root-capable machine. The non-root path is unchanged. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>