Rollup merge of rust-lang#87966 - pietroalbini:fix-pidfd-test, r=m-ou-se

Fix `command-create-pidfd` test inside unprivileged Docker containers

In `src/test/ui/command/command-create-pidfd.rs` (added rust-lang#81825), the detection code to skip the test on unsupported platforms doesn't account for unprivileged Docker containers (CI uses privileged containers), which leads to a test failure as you can't call the `clone3` syscall in that environment. This PR enhances the detection code to also consider unprivileged containers.

src/test/ui/command/command-create-pidfd.rs

@@ -15,7 +15,18 @@ fn has_clone3() -> bool {
  let err = (res == -1)
  .then(|| Error::last_os_error())
  .expect("probe syscall should not succeed");
- err.raw_os_error() != Some(libc::ENOSYS)
+
+ // If the `clone3` syscall is not implemented in the current kernel version it should return an
+ // `ENOSYS` error. Docker also blocks the whole syscall inside unprivileged containers, and
+ // returns `EPERM` (instead of `ENOSYS`) when a program tries to invoke the syscall. Because of
+ // that we need to check for *both* `ENOSYS` and `EPERM`.
+ //
+ // Note that Docker's behavior is breaking other projects (notably glibc), so they're planning
+ // to update their filtering to return `ENOSYS` in a future release:
+ //
+ // https://github.com/moby/moby/issues/42680
+ //
+ err.raw_os_error() != Some(libc::ENOSYS) && err.raw_os_error() != Some(libc::EPERM)
 }
 
 fn main() {