Add additional fixes for su_restricted_domain_template to make moving to sysadm_r and trying to su working correctly.
Allow admin SELinux users mounting / as private within a new mount namespace as root in MLS.