diff --git a/ChangeLog b/ChangeLog
index 8d2494e054..d98a9ce357 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2018-12-10  DJ Delorie  <dj@redhat.com>
+
+	[BZ #23948]
+	* support/test-container.c: Move postclean step to before we
+	change namespaces.
+
 2018-12-10  Joseph Myers  <joseph@codesourcery.com>
 
 	* scripts/gen-as-const.py (main): Handle --python option.
diff --git a/support/test-container.c b/support/test-container.c
index df450adfdb..1d1aebeaf3 100644
--- a/support/test-container.c
+++ b/support/test-container.c
@@ -921,6 +921,43 @@ main (int argc, char **argv)
       }
   }
 
+  if (do_postclean)
+    {
+      pid_t pc_pid = fork ();
+
+      if (pc_pid < 0)
+	{
+	  FAIL_EXIT1 ("Can't fork for post-clean");
+	}
+      else if (pc_pid > 0)
+	{
+	  /* Parent.  */
+	  int status;
+	  waitpid (pc_pid, &status, 0);
+
+	  /* Child has exited, we can post-clean the test root.  */
+	  printf("running post-clean rsync\n");
+	  rsync (pristine_root_path, new_root_path, 1);
+
+	  if (WIFEXITED (status))
+	    exit (WEXITSTATUS (status));
+
+	  if (WIFSIGNALED (status))
+	    {
+	      printf ("%%SIGNALLED%%\n");
+	      exit (77);
+	    }
+
+	  printf ("%%EXITERROR%%\n");
+	  exit (78);
+	}
+
+      /* Child continues.  */
+    }
+
+  /* This is the last point in the program where we're still in the
+     "normal" namespace.  */
+
 #ifdef CLONE_NEWNS
   /* The unshare here gives us our own spaces and capabilities.  */
   if (unshare (CLONE_NEWUSER | CLONE_NEWPID | CLONE_NEWNS) < 0)
@@ -974,14 +1011,6 @@ main (int argc, char **argv)
       int status;
       waitpid (child, &status, 0);
 
-      /* There's a bit of magic here, since the buildroot is mounted
-	 in our space, the paths are still valid, and since the mounts
-	 aren't recursive, it sees *only* the built root, not anything
-	 we would normally se if we rsync'd to "/" like mounted /dev
-	 files.  */
-      if (do_postclean)
-	  rsync (pristine_root_path, new_root_path, 1);
-
       if (WIFEXITED (status))
 	exit (WEXITSTATUS (status));