Description of problem:
When mounting "/" as user root (with sysadm_r role) in SELinux policy MLS
within a new mount namespace by:
mount("none", "/", "none", MS_REC|MS_PRIVATE, NULL);
error is returned:
errno=EACCES(13): Permission denied


# sestatus 
SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             mls
Current mode:                   enforcing
Mode from config file:          enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     denied
Max kernel policy version:      28

# ausearch -m avc -ts recent | audit2why
type=AVC msg=audit(1409051210.963:1380): avc:  denied  { mounton } for  pid=32494 comm="mountns01" path="/" dev="dm-1" ino=128 scontext=staff_u:sysadm_r:sysadm_t:s0-s15:c0.c1023 tcontext=system_u:object_r:root_t:s0 tclass=dir

        Was caused by:
                Missing type enforcement (TE) allow rule.

# ausearch -m avc -ts recent | grep mount | audit2allow 
#============= sysadm_t ==============
allow sysadm_t root_t:dir mounton;


Version-Release number of selected component (if applicable):
selinux-policy-3.12.1-153.el7.noarch
selinux-policy-mls-3.12.1-153.el7.noarch
kernel-3.10.0-123.el7.x86_64


How reproducible:
100%


Steps to Reproduce:
1. newrole -r sysadm_r
2. /bin/su -
3. Download se_test.c from attachments
4. gcc se_test.c -o se_test; ./se_test
5. Permission denied


Actual results:
Mounting "/" as private within a new mount namespace as root
(with sysadm_r role) in SELinux policy MLS doesn't work,
it returns error (errno=EACCES(13): Permission denied).

Expected results:
Mounting "/" as private within a new mount namespace as root
(with sysadm_r role) in SELinux policy MLS does work.

Additional info: