When you create a child process, you can clone your namespace or you can construct a new one for the child.
(Disclosure: I wrote the doc linked above.)
(Disclosure: I wrote the doc linked above.)
Yes. When creating the namespace for the child, the parent can map names to what whatever communication channels it chooses. If the parent wants to interpose on the child's access to "/dev/class/framebuffer", the parent could map that name to a channel that leads back to the parent.
> Can a process create a custom sandbox and run, say, AppMgr with limited permission to limit the permissions of all apps it manages?
Yes. That's useful for testing as well as for sandboxing.