Add additional fixes for su_restricted_domain_template to make moving to sysadm_r and trying to su working correctly.
Allow admin SELinux users mounting / as private within a new mount namespace as root in MLS.
Allow load_policy to rw inherited sssd pipes because of selinux_child.