Add additional constraints on user_u in selinux policy