title: How can I allow the child process to create nested user namespace?
body: <p>I use the following code to create a child process in a new user namespace:</p>
  
  <pre><code>pid_t child = syscall (SYS_clone, SIGCHLD | CLONE_NEWNS | CLONE_NEWUSER, NULL, NULL, NULL);
  </code></pre>
  
  <p>In the parent process, I write the <code>uid_map</code> and <code>gid_map</code> and map the current uid and pid to itself.</p>
  
  <p>In the child process I will call <code>execvp</code> to start a new process, and that process may call <code>unshare</code> with <code>CLONE_NEWUSER</code> flag, which operation is not permitted in the new user namespace.</p>
  
  <p>My question is, is it possible to permit the <code>unshare</code> operation to the process started by <code>execvp</code>?</p>
  
  <p>I followed the example in the man page of <code>user_namespace</code> and use <code>pipe</code> to ensure the <code>uid_map</code> and <code>gid_map</code> is written before <code>execvp</code> is invoked.</p>