[LTP] [PATCH 2/2] Add test for fanotify monitoring of tracing filesystem

[Martin Doucha]

Add a test that will start monitoring the kernel tracing filesystem,
write new configuration into tracing sysfiles and then verify
that the writes triggered fanotify events.

Signed-off-by: Martin Doucha <mdoucha@suse.cz>
---
 runtest/syscalls                              |   1 +
 runtest/tracing                               |   1 +
 testcases/kernel/syscalls/fanotify/.gitignore |   1 +
 .../kernel/syscalls/fanotify/fanotify25.c     | 126 ++++++++++++++++++
 4 files changed, 129 insertions(+)
 create mode 100644 testcases/kernel/syscalls/fanotify/fanotify25.c

diff --git a/runtest/syscalls b/runtest/syscalls
index 2f629e4e4..30224f5b4 100644
--- a/runtest/syscalls
+++ b/runtest/syscalls
@@ -671,6 +671,7 @@ fanotify21 fanotify21
 fanotify22 fanotify22
 fanotify23 fanotify23
 fanotify24 fanotify24
+fanotify25 fanotify25
 
 ioperm01 ioperm01
 ioperm02 ioperm02
diff --git a/runtest/tracing b/runtest/tracing
index d2700ca57..674e2ad97 100644
--- a/runtest/tracing
+++ b/runtest/tracing
@@ -3,6 +3,7 @@ ftrace_regression01	ftrace_regression01.sh
 ftrace_regression02	ftrace_regression02.sh
 ftrace-stress-test	ftrace_stress_test.sh 90
 dynamic_debug01		dynamic_debug01.sh
+fanotify25 fanotify25
 pt_full_trace_basic pt_test
 pt_snapshot_trace_basic pt_test -m
 pt_ex_user pt_test -e user
diff --git a/testcases/kernel/syscalls/fanotify/.gitignore b/testcases/kernel/syscalls/fanotify/.gitignore
index 16af3db85..d6d0599f1 100644
--- a/testcases/kernel/syscalls/fanotify/.gitignore
+++ b/testcases/kernel/syscalls/fanotify/.gitignore
@@ -22,4 +22,5 @@
 /fanotify22
 /fanotify23
 /fanotify24
+/fanotify25
 /fanotify_child
diff --git a/testcases/kernel/syscalls/fanotify/fanotify25.c b/testcases/kernel/syscalls/fanotify/fanotify25.c
new file mode 100644
index 000000000..c982f3225
--- /dev/null
+++ b/testcases/kernel/syscalls/fanotify/fanotify25.c
@@ -0,0 +1,126 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Copyright (C) 2026 SUSE LLC
+ * Author: Petr Pavlu <ppavlu@suse.cz>
+ * LTP port: Martin Doucha <mdoucha@suse.cz>
+ */
+
+/*\
+ * Verify that fanotify monitoring can be applied to the tracing filesystem
+ * and write events will be correctly delivered.
+ */
+
+#define _GNU_SOURCE
+#include "tst_test.h"
+#include "lapi/mount.h"
+
+#ifdef HAVE_SYS_FANOTIFY_H
+#include "fanotify.h"
+
+#define MNTPOINT "/sys/kernel/tracing"
+#define EVENTS_SYSFILE MNTPOINT "/kprobe_events"
+
+static const struct traceconfig {
+	const char *filename;
+	const char *wdata;
+} trace_cmds[] = {
+	{EVENTS_SYSFILE, "p:ltp_load_module_0 load_module"},
+	{MNTPOINT "/events/kprobes/ltp_load_module_0/enable", "1"},
+	{MNTPOINT "/events/kprobes/ltp_load_module_0/enable", "0"},
+	{EVENTS_SYSFILE, "-:ltp_load_module_0"},
+	{}
+};
+
+static int fan_fd = -1;
+static int unmount_needed;
+
+static void setup(void)
+{
+	if (tst_fs_type(MNTPOINT) != TST_TRACEFS_MAGIC) {
+		SAFE_MOUNT("tracefs", MNTPOINT, "tracefs",
+			MS_NODEV | MS_NOEXEC | MS_NOSUID, NULL);
+		unmount_needed = 1;
+	}
+
+	if (access(EVENTS_SYSFILE, F_OK))
+		tst_brk(TCONF, "Kprobe events not supported by kernel");
+
+	fan_fd = SAFE_FANOTIFY_INIT(FAN_CLASS_NOTIF | FAN_NONBLOCK, O_RDONLY);
+	SAFE_FANOTIFY_MARK(fan_fd, FAN_MARK_ADD | FAN_MARK_MOUNT, FAN_MODIFY,
+		-1, MNTPOINT);
+}
+
+static void do_child(void)
+{
+	int i, fd, events, ret;
+	pid_t pid = getpid();
+	struct fanotify_event_metadata buf;
+
+	for (i = 0, events = 0; trace_cmds[i].filename; i++) {
+		fd = SAFE_OPEN(trace_cmds[i].filename, O_WRONLY, 0644);
+		SAFE_WRITE(1, fd, trace_cmds[i].wdata,
+			strlen(trace_cmds[i].wdata));
+		SAFE_CLOSE(fd);
+
+		while ((ret = read(fan_fd, &buf, sizeof(buf))) > 0) {
+			if (buf.pid != pid)
+				continue;
+
+			if (!(buf.mask & FAN_MODIFY)) {
+				tst_res(TFAIL, "Unexpected event %llx",
+					buf.mask);
+				continue;
+			}
+
+			events++;
+		}
+
+		if (ret < 0 && errno != EAGAIN)
+			tst_res(TFAIL | TERRNO, "fanotify read() failed");
+	}
+
+	if (events == i)
+		tst_res(TPASS, "Received %d events", events);
+	else
+		tst_res(TFAIL, "Received %d events, expected %d", events, i);
+}
+
+static void run(void)
+{
+	/*
+	 * Fork a child to do the actual trace writes, otherwise tracefs
+	 * would be busy until the current process exits and it would become
+	 * impossible to unmount in cleanup().
+	 */
+	if (!SAFE_FORK()) {
+		do_child();
+		SAFE_CLOSE(fan_fd);
+		exit(0);
+	}
+}
+
+static void cleanup(void)
+{
+	if (fan_fd >= 0)
+		SAFE_CLOSE(fan_fd);
+
+	if (unmount_needed)
+		SAFE_UMOUNT(MNTPOINT);
+}
+
+static struct tst_test test = {
+	.test_all = run,
+	.setup = setup,
+	.cleanup = cleanup,
+	.needs_root = 1,
+	.forks_child = 1,
+	.taint_check = TST_TAINT_W | TST_TAINT_D,
+	.needs_kconfigs = (const char *[]) {
+		"CONFIG_TRACING",
+		NULL
+	}
+};
+
+#else
+	TST_TEST_TCONF("system doesn't have required fanotify support");
+#endif
-- 
2.52.0