make RestrictSys entries configurable

This PR addresses the TODO from `namespaces/init.go` which was added there by crosbymichael. 
I think this is a bad name for the var because most of these entries are not in sys but in proc