Fix SELinux contexts for a SU binary
Apps can't elevate their privileges by making use of set-uid-root or file capabilities. It's due to Security Enhancements in Android 4.3:


  
  No setuid/setgid programs. Added support for filesystem capabilities to Android system files and removed all setuid/setguid programs.  This reduces root attack surface and the likelihood of potential security vulnerabilities.
  Restrict Setuid from Android Apps. The /system partition is now mounted nosuid for zygote-spawned processes, preventing Android applications from executing setuid programs. This reduces root attack surface and the likelihood of potential security vulnerabilities.
  Capability bounding. Android zygote and ADB now use prctl(PR_CAPBSET_DROP) to drop unnecessary capabilities prior to executing applications. This prevents Android applications and applications launched from the shell from acquiring privileged capabilities.
  NO_NEW_PRIVS. Android zygote now uses prctl(PR_SET_NO_NEW_PRIVS) to block addition of new privileges prior to execution application code. This prevents Android applications from performing operations which can elevate privileges via execve. (This requires Linux kernel version 3.5 or greater).
  


Default SELinux context of /system/xbin/su is u:object_r:su_exec:s0 but it may not be the only constraint.

For more details see:


What special privileges “/system/xbin/su” does have w.r.t. root access?


Also:


How to manually root a phone?