I think you can just use an existing test case (like any of the ones with "default" or "basic" in their name) to test that selinux --enforcing works. That's the default, so it can easily get tested at the same time as something else. That'll keep the number of VMs we have to spawn down just a little bit and make sure things run a little faster.