for system hardening, nscd should automatically create new namespaces for itself when it starts up. see the unshare(2) manpage for some more details. the kernel allows for these to be turned off, so we need to test for each one at runtime. we'll get back EINVAL when one isn't available.
We need to consider that NSS service modules can do basically anything, so a high-quality implementation is difficult. An initial implementation could be restricted to the files and dns modules.