The need for privilege escalation to create the namespace is basically the rub for this sort of thing. It seems like the main thing that makes true plan9-style

The need for privilege escalation to create the namespace is basically the rub for this sort of thing. It seems like the main thing that makes true plan9-style namespacing unrealistic is the security implications, since the filesystem is used extensively to control privilege escalation. Whether it's through setuid flags or through /etc/sudoers or /etc/groups, at some point a privileged program (su or sudo) might be running in an unknown or untrusted namespace where the facts visible to that program make a solid case for allowing the escalation. I'm not sure this tension can ever really be resolved without also adopting a plan9-style out-of-process escalation mechanism. Which is a huge departure from POSIX in and of itself, as far as I know. I'm really not sure how HURD deals with this, to be honest, or if it does at all.