kernel: Only expose su when daemon is running