The rejection inside the new PID namespace ran without privileged mode, so it never reached the caller lookup, and nothing would have caught a check that accepted -p anywhere in the arguments.
The rejection inside the new PID namespace ran without privileged mode, so it never reached the caller lookup, and nothing would have caught a check that accepted -p anywhere in the arguments.