a root in a namespace is a root in a namespace. if its a fs namespace, can't chroot up. if its also a network namespace, can't use network resources that aren't

a root in a namespace is a root in a namespace. if its a fs namespace, can't chroot up. if its also a network namespace, can't use network resources that aren't allowed by the namespace. and so on. but, a regular user can't create a namespace with root in it. that's what's missing for example. Note that, again, RSBAC does support fully virtual users for example (akin to namespaces for users)