shadow-stack-smoke test

Rust will start marking all x86_64 code with SHSTK for CET support
in RHEL, CentOS and Fedora, by default and without need to pass
any flags.

This new test verifies that rust code always contain the SHSTK mark,
testing both binary and cdylib cases

tests/Sanity/shadow-stack-smoke/hello.rs

@@ -0,0 +1,3 @@
+fn main() {
+    println!("Hello, world!");
+}

tests/Sanity/shadow-stack-smoke/main.fmf

@@ -0,0 +1,27 @@
+summary: Verify rustc enables Shadow Stack by default
+description: |
+    rustc must emit the SHSTK GNU property note on binaries and shared
+    libraries by default for x86_64-unknown-linux-gnu, without any extra
+    flags, so glibc can enable Intel CET Shadow Stack for them.
+duration: 5m
+tier: 1
+tag+:
+  - CI-Tier-1
+link+:
+  - verifies: https://redhat.atlassian.net/browse/RHEL-213919
+  - verifies: https://redhat.atlassian.net/browse/RHEL-223924
+  - relates: https://fedoraproject.org/wiki/Changes/ShadowStack
+adjust+:
+  - when: arch != x86_64
+    enabled: false
+    continue: false
+    because: Shadow Stack (Intel CET) is x86_64 only
+
+  # Shadow stack enabled only in RHEL 9.9+ and 10.3+ and F45+
+  # Centos Stream is RHEL upstream, available always.
+  # Not supported in RHEL-8 and older
+  - when: distro == rhel-9 and distro < rhel-9.9 or
+      distro == rhel-10 and distro < rhel-10.3 or
+      distro == fedora and distro < fedora-45 or
+      distro <= rhel-8
+    enabled: false

tests/Sanity/shadow-stack-smoke/runtest.sh

@@ -0,0 +1,40 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="$(rpm -qf $(which rustc))"
+PACKAGES=${PACKAGES:-$PACKAGE}
+
+# rustc must mark x86_64-unknown-linux-gnu output as Shadow Stack (SHSTK)
+# compatible by default, without any extra flags:
+# https://fedoraproject.org/wiki/Changes/ShadowStack
+# https://issues.redhat.com/browse/RHEL-213919
+TARGET="x86_64-unknown-linux-gnu"
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlAssertRpm --all
+        rlRun "tmp=\$(mktemp -d)" 0 "Create tmp directory"
+        rlRun "cp hello.rs $tmp"
+        rlRun "pushd $tmp"
+        rlRun "set -o pipefail"
+    rlPhaseEnd
+
+    rlPhaseStartTest "binary is marked SHSTK by default"
+        rlRun "rustc --target $TARGET hello.rs -o hello"
+        rlRun "./hello | grep 'Hello, world!'"
+        rlRun "readelf -n hello > hello-notes.out"
+        rlAssertGrep "SHSTK" hello-notes.out
+    rlPhaseEnd
+
+    rlPhaseStartTest "cdylib is marked SHSTK by default"
+        rlRun "rustc --target $TARGET --crate-type cdylib hello.rs -o libhello.so"
+        rlRun "readelf -n libhello.so > libhello-notes.out"
+        rlAssertGrep "SHSTK" libhello-notes.out
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "popd"
+        rlRun "rm -r $tmp" 0 "Remove tmp directory"
+    rlPhaseEnd
+rlJournalEnd