[codedokode]

> You can just set ACLs on such files.

I am not sure if I can set ACL or ownership on /proc files, it is not a disk-based filesystem.

> You don't get the ability to mount just because you created an unprivileged user namespace.

Please consult "man user_namespaces", section "Effect of capabilities within a user namespace". It clearly says that one can mount /proc inside a mount namespace governed by a user namespace without being root. The reason why you weren't aware is probably because the rules related to namespaces and capabilities are extremely complicated.

> Vim is a text editor, but you can e.g. have it make a call with ssh to get info from wherever and put that info into the buffer.

I definitely do not want proprietary applications running ssh on my system without me knowing.