helper/bwrap: pass --unshare-user when unshare everything

Bubblewrap apparently requires --unshare-user even when --unshare-all is set to apply --disable-userns. This behaviour is not clearly documented.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>

helper/bwrap/config.bool.go

@@ -21,7 +21,7 @@ const (
 )
 
 var boolArgs = func() (b [boolC][]string) {
-	b[UnshareAll] = []string{"--unshare-all"}
+	b[UnshareAll] = []string{"--unshare-all", "--unshare-user"}
 	b[UnshareUser] = []string{"--unshare-user"}
 	b[UnshareIPC] = []string{"--unshare-ipc"}
 	b[UnsharePID] = []string{"--unshare-pid"}

helper/bwrap/config_test.go

@@ -49,6 +49,7 @@ func TestConfig_Args(t *testing.T) {
 			},
 			want: []string{
 				"--unshare-all",
+				"--unshare-user",
 				"--disable-userns",
 				"--assert-userns-disabled",
 				"--clearenv",