Comment 14 for bug 1656121

I wonder if the nsenter denial is related to bug #1648903. Ie, complain mode blocked 'ip netns list' (etc). You should be able to workaround that be adjusting the profile to allow nsenter so that it is allowed and not affected by complain mode.