[LTP] [PATCH STAGING 07/16] fchroot04: test fchroot() into failfs as root

[Andrea Cervesato]

From: Andrea Cervesato <andrea.cervesato@suse.com>

Verify that entering failfs with the FD_FAILFS_ROOT sentinel succeeds
with CAP_SYS_CHROOT and that every absolute path lookup then fails
with EOPNOTSUPP, while the working directory is reported as
unreachable by getcwd().

Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
---
 runtest/staging                               |  1 +
 testcases/kernel/syscalls/fchroot/.gitignore  |  1 +
 testcases/kernel/syscalls/fchroot/fchroot04.c | 66 +++++++++++++++++++++++++++
 3 files changed, 68 insertions(+)

diff --git a/runtest/staging b/runtest/staging
index 13635037b..91dfdba08 100644
--- a/runtest/staging
+++ b/runtest/staging
@@ -3,3 +3,4 @@
 fchroot01 fchroot01
 fchroot02 fchroot02
 fchroot03 fchroot03
+fchroot04 fchroot04
diff --git a/testcases/kernel/syscalls/fchroot/.gitignore b/testcases/kernel/syscalls/fchroot/.gitignore
index 235befd99..9270c1408 100644
--- a/testcases/kernel/syscalls/fchroot/.gitignore
+++ b/testcases/kernel/syscalls/fchroot/.gitignore
@@ -1,3 +1,4 @@
 fchroot01
 fchroot02
 fchroot03
+fchroot04
diff --git a/testcases/kernel/syscalls/fchroot/fchroot04.c b/testcases/kernel/syscalls/fchroot/fchroot04.c
new file mode 100644
index 000000000..5a56e84bd
--- /dev/null
+++ b/testcases/kernel/syscalls/fchroot/fchroot04.c
@@ -0,0 +1,66 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Copyright (C) 2026 SUSE LLC Andrea Cervesato <andrea.cervesato@suse.com>
+ */
+
+/*\
+ * Test :manpage:`fchroot(2)` with the FD_FAILFS_ROOT sentinel as a
+ * privileged process.
+ *
+ * fchroot() was introduced in Linux v7.3 together with failfs, a kernel
+ * internal filesystem where every operation fails with EOPNOTSUPP. The
+ * FD_FAILFS_ROOT sentinel moves the process root there without needing a
+ * file descriptor: it is the ``fs_struct`` equivalent of RESOLVE_BENEATH.
+ *
+ * The test verifies that entering failfs succeeds with CAP_SYS_CHROOT and
+ * that every absolute path lookup then fails with EOPNOTSUPP. The working
+ * directory, left behind in the real filesystem, is consequently reported
+ * as unreachable by :manpage:`getcwd(2)`.
+ *
+ * The syscall runs in a forked child because leaving failfs requires a
+ * mount namespace file descriptor and the parent needs its root for the
+ * test framework cleanup.
+ */
+
+#define _GNU_SOURCE
+#include <fcntl.h>
+#include <limits.h>
+#include <sys/stat.h>
+#include "tst_test.h"
+#include "lapi/fcntl.h"
+#include "lapi/syscalls.h"
+
+static void run(void)
+{
+	if (!SAFE_FORK()) {
+		char buf[PATH_MAX];
+
+		TST_EXP_PASS(tst_syscall(__NR_fchroot, FD_FAILFS_ROOT, 0),
+			"fchroot() with the FD_FAILFS_ROOT sentinel");
+
+		TST_EXP_FAIL2(open("/etc/passwd", O_RDONLY), EOPNOTSUPP,
+			"absolute file open");
+
+		TST_EXP_FAIL(mkdir("/foo", 0700), EOPNOTSUPP,
+			"absolute directory creation");
+
+		/*
+		 * The libc getcwd() wrapper rejects the "(unreachable)"
+		 * prefix produced by the kernel, so call the raw syscall.
+		 */
+		TEST(tst_syscall(__NR_getcwd, buf, sizeof(buf)));
+		if (TST_RET > 0)
+			TST_EXP_EQ_STRN(buf, "(unreachable)", 13);
+		else
+			tst_res(TFAIL | TTERRNO, "getcwd() failed");
+
+		exit(0);
+	}
+}
+
+static struct tst_test test = {
+	.test_all = run,
+	.needs_root = 1,
+	.needs_tmpdir = 1,
+	.forks_child = 1,
+};

-- 
2.51.0