[Paco Huelsz (frhuelsz)]

Summary

• Add a manual Fedora SELinux-enforcing janitor harness and six synthetic liveness-parser tests. No CI workflow or runner is added.
• Exercise actual non-root Tailor clean against a disposable root-owned user_home_t artifact, plus the stale tools-dir pre-IC removal through actual tailor build with a deliberately non-IC small toolchain image. All binds stay inside a disposable guest workspace; no automatic :z/:Z relabeling or host-root bind.

Measured on Fedora 43 (SELinux Enforcing)

With a rootful Podman API accessible to a non-root guest user, on the same disposable VM:

• Baseline Tailor: clean base-os exited 1 with Permission denied; final janitor-option prototype 8c6fdedd: clean base-os exited 0, removed the root-owned artifact, and left its parent label unchanged.
• Baseline build preic: exited 1 at janitor stale tools-dir pre-clean (Permission denied, marker remained). Prototype build preic: removed the stale marker, then exited 1 later as intended because the fake IC image lacks customize. The Python harness distinguishes these failure locations and exits 0 for the expected result.

Not proven: a successful real Image Customizer build, post-build chown, rootless Podman, Docker, remote daemons, or safety with live loop devices/mounts. The fixture-side local liveness scan is not a production guard or a remote-daemon safety guarantee. AVC-log absence is not used as evidence.

Companion janitor-option implementation: #852. The --expect-fixed modes target a binary with that separate fix; this harness PR remains independently based on main.

Validation / CI plan

• Six stdlib unittest cases pass; both Python files parse and the harness --help works. README workflow reference and public-content scan checked. just validate is unavailable (this checkout has no justfile).
• No enforcing runner is available in existing CI. A future opt-in job needs a dedicated ephemeral Fedora SELinux-enforcing VM, KVM, non-root access to a rootful Podman socket (root-equivalent inside the VM), MCR access, and a Tailor binary built with the pinned toolchain. It must check getenforce=Enforcing and run both --expect-fixed modes; do not run this on an Ubuntu container runner.

[azure-pipelines]

Azure Pipelines:
1 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.