[tests/selinux] pr775-checkpolicy-revdeps: Add test for unexpected fanotify denials on anonymous pipes

[Ondrej Mosnacek <omosnace@redhat.com>]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : dc54730c66a51fff4fc2b51a282cb0a1011a4043
            Author : Ondrej Mosnacek <omosnace@redhat.com>
            Date   : 2026-02-16T10:13:08+01:00
            Stats  : +113/-0 in 4 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/dc54730c66a51fff4fc2b51a282cb0a1011a4043?branch=pr775-checkpolicy-revdeps

            Log:
            Add test for unexpected fanotify denials on anonymous pipes

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>

---
diff --git a/kernel/fanotify-mark-anon-pipe/.gitignore b/kernel/fanotify-mark-anon-pipe/.gitignore
new file mode 100644
index 0000000..6263bf3
--- /dev/null
+++ b/kernel/fanotify-mark-anon-pipe/.gitignore
@@ -0,0 +1 @@
+reproducer

diff --git a/kernel/fanotify-mark-anon-pipe/main.fmf b/kernel/fanotify-mark-anon-pipe/main.fmf
new file mode 100644
index 0000000..da7a540
--- /dev/null
+++ b/kernel/fanotify-mark-anon-pipe/main.fmf
@@ -0,0 +1,21 @@
+summary: Verify no invalid denials for fanotify_mark() on an anonymous pipe
+description: |
+    Verify that calling fanotify_mark() on an anonymous pipe just fails
+    with EINVAL and doesn't fail on SELinux checks earlier.
+contact: Ondrej Mosnacek <omosnace@redhat.com>
+component:
+  - kernel
+framework: beakerlib
+require:
+  - gcc
+duration: 5m
+tier: 2
+check:
+  - how: avc
+enabled: true
+adjust+:
+  - enabled: false
+    when: distro < rhel-9
+    because: On RHEL-8 fanotify mark is allowed on anonymous pipes.
+link:
+  - verifies: https://issues.redhat.com/browse/RHEL-53850

diff --git a/kernel/fanotify-mark-anon-pipe/reproducer.c b/kernel/fanotify-mark-anon-pipe/reproducer.c
new file mode 100644
index 0000000..c55b17d
--- /dev/null
+++ b/kernel/fanotify-mark-anon-pipe/reproducer.c
@@ -0,0 +1,66 @@
+/* SPDX-License-Identifier: GPLv2 */
+/* Copyright (c) 2026 Red Hat, Inc. */
+/* Author: Ondrej Mosnacek <omosnace@redhat.com> */
+
+#define _GNU_SOURCE
+
+#include <errno.h>
+#include <string.h>
+#include <stdio.h>
+
+#include <fcntl.h>
+#include <unistd.h>
+
+#include <sys/fanotify.h>
+
+int main(int argc, char **argv)
+{
+	int ffd, ret, rc, pfd[2];
+
+	ret = pipe2(pfd, O_CLOEXEC);
+	if (ret == -1) {
+		perror("pipe2");
+		rc = 2;
+		goto exit;
+	}
+
+	ffd = fanotify_init(FAN_CLASS_NOTIF, O_RDONLY);
+	if (ffd == -1) {
+		perror("fanotify_init");
+		rc = 2;
+		goto exit_close_pipes;
+	}
+
+	rc = 0;
+
+	ret = fanotify_mark(ffd, FAN_MARK_ADD | FAN_MARK_MOUNT, FAN_ACCESS,
+			    pfd[0], NULL);
+	if (ret == 0) {
+		printf("FAIL: fanotify_mark() with FAN_MARK_MOUNT succeeded\n");
+		rc = 1;
+	} else if (errno == EINVAL) {
+		printf("PASS: fanotify_mark() with FAN_MARK_MOUNT failed with EINVAL as expected\n");
+	} else {
+		printf("FAIL: fanotify_mark() with FAN_MARK_MOUNT failed with %s\n", strerror(errno));
+		rc = 1;
+	}
+
+	ret = fanotify_mark(ffd, FAN_MARK_ADD | FAN_MARK_FILESYSTEM, FAN_ACCESS,
+			    pfd[0], NULL);
+	if (ret == 0) {
+		printf("FAIL: fanotify_mark() with FAN_MARK_FILESYSTEM succeeded\n");
+		rc = 1;
+	} else if (errno == EINVAL) {
+		printf("PASS: fanotify_mark() with FAN_MARK_FILESYSTEM failed with EINVAL as expected\n");
+	} else {
+		printf("FAIL: fanotify_mark() with FAN_MARK_FILESYSTEM failed with %s\n", strerror(errno));
+		rc = 1;
+	}
+
+	close(ffd);
+exit_close_pipes:
+	close(pfd[0]);
+	close(pfd[1]);
+exit:
+	return rc;
+}

diff --git a/kernel/fanotify-mark-anon-pipe/runtest.sh b/kernel/fanotify-mark-anon-pipe/runtest.sh
new file mode 100755
index 0000000..16075eb
--- /dev/null
+++ b/kernel/fanotify-mark-anon-pipe/runtest.sh
@@ -0,0 +1,25 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# SPDX-License-Identifier: GPLv2
+# Copyright (c) 2026 Red Hat, Inc.
+# Author: Ondrej Mosnacek <omosnace@redhat.com>
+
+# Include Beakerlib environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlRun "uname -r" 0 "Print kernel version"
+
+        rlRun "gcc -o reproducer reproducer.c" 0 "Compile the reproducer"
+    rlPhaseEnd
+
+    rlPhaseStartTest
+        rlRun "./reproducer" 0 "Run the reproducer"
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "rm -f reproducer" 0 "Delete the reproducer binary"
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd