userns

func IsPIDAdminCapable ¶

func IsPIDAdminCapable(pid uint32) (bool, error)

IsPIDAdminCapable returns true if the PID is considered an admin of a user namespace, that is, it's in either in the init user namespace or one created by the host root and has CAP_SYS_ADMIN. The protects against a less privileged user either mounting a directory over a tree that gives them more access (e.g. /etc/sudoers.d) or hiding files.