[Metrohan]

New installations store the PSK outside Fedora's fprintd SELinux file-context rule. This changes the default to /var/lib/fprint/gxfp/psk_raw32.bin, while retaining /var/lib/fprintd/gxfp/psk_raw32.bin as a fallback only when the new default is absent. Explicit FP_GXFP_PSK paths and access errors never silently select another key.

Provisioning protects existing files at both locations, keeps explicit replacement on legacy-only installations at the old path, rejects ambiguous two-key replacement, and restores SELinux labels when available. Doctor and the English/Turkish documentation explain selection, migration and legacy labels. TarekELz's existing GPL-2.0 device policy is unchanged.

Validation on commit bc12719:

• 23 offline regression tests passed, including red/green coverage for new-path selection, key protection and doctor access errors.
• Userspace build and CTest: 1/1 passed.
• Configured libfprint build passed; Meson: 5 passed, 20 skipped (disabled drivers/introspection/hwdb).
• Meson required clearing inherited LD_LIBRARY_PATH in the test process because /opt/MVS caused a libusb loader conflict.
• Independent code review findings were addressed. Real Fedora enforcing enroll/verify/sudo acceptance is still pending.

Keeping this as a draft pending Fedora acceptance. Test instructions: FEDORA-TEST.md.

Refs #8; this PR does not close the issue automatically.

[Metrohan]

Maintainer test on Fedora 44 with SELinux enforcing. Candidate libfprint built
from this branch's head (2378be1) and installed over my existing fork under
/usr/local/lib64/libfprint-gxfp.

Hardware/OS: MateBook D16 2024 (MCLF-XX), FW GF_GCC_EC_20067, Fedora 44,
kernel 6.19.10-300.fc44, SELinux enforcing. Existing key had been provisioned
earlier on another OS install and copied over; no provisioning was run here.

Results, per case from FEDORA-TEST.md:

1. Legacy fallback (key only at /var/lib/fprintd/gxfp/): fprintd-verify
   reached the sensor and returned verify-no-match (PSK read, TLS up, image
   captured). No PSK-related error in the journal.
2. New path, same key: copied the 32-byte key to /var/lib/fprint/gxfp/
   (dir 0700, file 0600, root:root), restorecon -Rv. Labels:
   fprintd_var_lib_t on the dir and file, gxfp_device_t on /dev/gxfp.
   cmp confirmed the copies are identical.
   2b. With the legacy file temporarily moved aside (new path only):
   fprintd-verify again completed without a PSK error (verify-no-match).
   The legacy file was restored afterwards.
3. provision-psk.sh with both files present refused both with and without
   --replace (exit 2, "Both new and legacy PSK paths exist"). Key mtimes and
   sizes were unchanged and no mktemp directory was created, i.e. the sensor
   tool was never reached.
4. After re-enrolling a finger with the candidate library, fprintd-verify
   returned verify-match.

Not tested: fresh provisioning (case 4 of the protocol; I did not want to
replace a working sensor key), the single-path refusal without --replace
(read in the code, not run), sudo with a fingerprint, the GDM lock screen,
and a reboot.

AVC: the only denials seen were fprintd_t reading nr_hugepages
(sysctl_vm_t). One occurred before the candidate library was installed, so
I believe it is unrelated to this change; I have not traced which component
does the read.

I am keeping this as a draft until TarekELz has run the same cases on their
Fedora 44 machine.