pub const NAMESPACE_FLAG_SYSCALLS: &[i64];Expand description
Syscalls whose namespace flags are refused with EPERM by the filter
itself, as a default container refuses them: a tracee in a mount
namespace of its own could not be served by a supervisor that does the
filesystem work in its own. clone3 carries its flags in memory and is
inspected by a handler instead; setns is refused outright.