1539670 - Assert that our Linux CI environment allows unprivileged user namespaces

Status: NEW

(Core :: Security: Process Sandboxing, enhancement, P3)

Description

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

We should have a test that fails if unprivileged user namespace support isn't available, and run it at least on our own CI.

Currently we don't have anything like that, so if something changed in our CI configuration to block unshare (and container technologies tend to like quietly blocking that for security defense-in-depth, because most applications don't have their own sandboxes), we probably wouldn't find out, and would quietly lose test coverage for something that's deployed for most of our Linux userbase.

As for developers running tests locally and on a Linux distro that doesn't allow namespaces, I don't know if anyone runs the entire testsuite locally anymore (vs. local tests for the specific part they're working on + full tests on Try), but if there are then we could consider skipping this test in that case. I'm assuming there's some environment variable or something that a test could read to determine if it's on CI… but then if that changes then we could quietly lose test coverage again, so that might not be the best idea. Another alternative is just to tell anyone in that situation to either enable namespaces or do a local edit to skip the test.