namespace-util: Merge namespace_enter_delegated() into namespace_enter() (#40669)

There's no need to pass in a boolean to decide whether we use
namespace_enter_delegated() or not. Instead, we can just check if we
have CAP_SYS_ADMIN in our own user namespace. If we don't, then we have
to insist on a child user namespace being passed in and we have to enter
it first to get CAP_SYS_ADMIN as without CAP_SYS_ADMIN we wouldn't be
able
to call setns() in the first place. If we do have CAP_SYS_ADMIN, we can
always enter the other namespaces first before entering the user
namespace.

Additionally, we don't fail anymore if we can't reset the UID/GID since
a
root user might not always be available in every user namespace we might
enter.

src/basic/process-util.h

@@ -199,7 +199,6 @@ int namespace_fork_full(
                 int netns_fd,
                 int userns_fd,
                 int root_fd,
-                bool delegated,
                 PidRef *ret);
 
 static inline int namespace_fork(
@@ -214,7 +213,7 @@ static inline int namespace_fork(
                 PidRef *ret) {
 
         return namespace_fork_full(outer_name, inner_name, NULL, 0, flags,
-                                   pidns_fd, mntns_fd, netns_fd, userns_fd, root_fd, false,
+                                   pidns_fd, mntns_fd, netns_fd, userns_fd, root_fd,
                                    ret);
 }