[tests/rust] main: shadow-stack-smoke test

[Jesus Checa Hidalgo <jchecahi@redhat.com>]

            A new commit has been pushed.

            Repo   : tests/rust
            Branch : main
            Commit : b3bb3e8b771d55998232d4da9a8ab1ac6e0cd028
            Author : Jesus Checa Hidalgo <jchecahi@redhat.com>
            Date   : 2026-08-14T11:49:56+02:00
            Stats  : +70/-0 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/rust/c/b3bb3e8b771d55998232d4da9a8ab1ac6e0cd028?branch=main

            Log:
            shadow-stack-smoke test

Rust will start marking all x86_64 code with SHSTK for CET support
in RHEL, CentOS and Fedora, by default and without need to pass
any flags.

This new test verifies that rust code always contain the SHSTK mark,
testing both binary and cdylib cases

---
diff --git a/tests/Sanity/shadow-stack-smoke/hello.rs b/tests/Sanity/shadow-stack-smoke/hello.rs
new file mode 100644
index 0000000..e7a11a9
--- /dev/null
+++ b/tests/Sanity/shadow-stack-smoke/hello.rs
@@ -0,0 +1,3 @@
+fn main() {
+    println!("Hello, world!");
+}

diff --git a/tests/Sanity/shadow-stack-smoke/main.fmf b/tests/Sanity/shadow-stack-smoke/main.fmf
new file mode 100644
index 0000000..565ad68
--- /dev/null
+++ b/tests/Sanity/shadow-stack-smoke/main.fmf
@@ -0,0 +1,27 @@
+summary: Verify rustc enables Shadow Stack by default
+description: |
+    rustc must emit the SHSTK GNU property note on binaries and shared
+    libraries by default for x86_64-unknown-linux-gnu, without any extra
+    flags, so glibc can enable Intel CET Shadow Stack for them.
+duration: 5m
+tier: 1
+tag+:
+  - CI-Tier-1
+link+:
+  - verifies: https://redhat.atlassian.net/browse/RHEL-213919
+  - verifies: https://redhat.atlassian.net/browse/RHEL-223924
+  - relates: https://fedoraproject.org/wiki/Changes/ShadowStack
+adjust+:
+  - when: arch != x86_64
+    enabled: false
+    continue: false
+    because: Shadow Stack (Intel CET) is x86_64 only
+
+  # Shadow stack enabled only in RHEL 9.9+ and 10.3+ and F45+
+  # Centos Stream is RHEL upstream, available always.
+  # Not supported in RHEL-8 and older
+  - when: distro == rhel-9 and distro < rhel-9.9 or
+      distro == rhel-10 and distro < rhel-10.3 or
+      distro == fedora and distro < fedora-45 or
+      distro <= rhel-8
+    enabled: false

diff --git a/tests/Sanity/shadow-stack-smoke/runtest.sh b/tests/Sanity/shadow-stack-smoke/runtest.sh
new file mode 100755
index 0000000..103a7a2
--- /dev/null
+++ b/tests/Sanity/shadow-stack-smoke/runtest.sh
@@ -0,0 +1,40 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="$(rpm -qf $(which rustc))"
+PACKAGES=${PACKAGES:-$PACKAGE}
+
+# rustc must mark x86_64-unknown-linux-gnu output as Shadow Stack (SHSTK)
+# compatible by default, without any extra flags:
+# https://fedoraproject.org/wiki/Changes/ShadowStack
+# https://issues.redhat.com/browse/RHEL-213919
+TARGET="x86_64-unknown-linux-gnu"
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlAssertRpm --all
+        rlRun "tmp=\$(mktemp -d)" 0 "Create tmp directory"
+        rlRun "cp hello.rs $tmp"
+        rlRun "pushd $tmp"
+        rlRun "set -o pipefail"
+    rlPhaseEnd
+
+    rlPhaseStartTest "binary is marked SHSTK by default"
+        rlRun "rustc --target $TARGET hello.rs -o hello"
+        rlRun "./hello | grep 'Hello, world!'"
+        rlRun "readelf -n hello > hello-notes.out"
+        rlAssertGrep "SHSTK" hello-notes.out
+    rlPhaseEnd
+
+    rlPhaseStartTest "cdylib is marked SHSTK by default"
+        rlRun "rustc --target $TARGET --crate-type cdylib hello.rs -o libhello.so"
+        rlRun "readelf -n libhello.so > libhello-notes.out"
+        rlAssertGrep "SHSTK" libhello-notes.out
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "popd"
+        rlRun "rm -r $tmp" 0 "Remove tmp directory"
+    rlPhaseEnd
+rlJournalEnd