From b3bb3e8b771d55998232d4da9a8ab1ac6e0cd028 Mon Sep 17 00:00:00 2001
From: Jesus Checa Hidalgo <jchecahi@redhat.com>
Date: Mon, 10 Aug 2026 10:04:22 +0200
Subject: [PATCH] shadow-stack-smoke test

Rust will start marking all x86_64 code with SHSTK for CET support
in RHEL, CentOS and Fedora, by default and without need to pass
any flags.

This new test verifies that rust code always contain the SHSTK mark,
testing both binary and cdylib cases
---
 tests/Sanity/shadow-stack-smoke/hello.rs   |  3 ++
 tests/Sanity/shadow-stack-smoke/main.fmf   | 27 +++++++++++++++
 tests/Sanity/shadow-stack-smoke/runtest.sh | 40 ++++++++++++++++++++++
 3 files changed, 70 insertions(+)
 create mode 100644 tests/Sanity/shadow-stack-smoke/hello.rs
 create mode 100644 tests/Sanity/shadow-stack-smoke/main.fmf
 create mode 100755 tests/Sanity/shadow-stack-smoke/runtest.sh

diff --git a/tests/Sanity/shadow-stack-smoke/hello.rs b/tests/Sanity/shadow-stack-smoke/hello.rs
new file mode 100644
index 0000000..e7a11a9
--- /dev/null
+++ b/tests/Sanity/shadow-stack-smoke/hello.rs
@@ -0,0 +1,3 @@
+fn main() {
+    println!("Hello, world!");
+}
diff --git a/tests/Sanity/shadow-stack-smoke/main.fmf b/tests/Sanity/shadow-stack-smoke/main.fmf
new file mode 100644
index 0000000..565ad68
--- /dev/null
+++ b/tests/Sanity/shadow-stack-smoke/main.fmf
@@ -0,0 +1,27 @@
+summary: Verify rustc enables Shadow Stack by default
+description: |
+    rustc must emit the SHSTK GNU property note on binaries and shared
+    libraries by default for x86_64-unknown-linux-gnu, without any extra
+    flags, so glibc can enable Intel CET Shadow Stack for them.
+duration: 5m
+tier: 1
+tag+:
+  - CI-Tier-1
+link+:
+  - verifies: https://redhat.atlassian.net/browse/RHEL-213919
+  - verifies: https://redhat.atlassian.net/browse/RHEL-223924
+  - relates: https://fedoraproject.org/wiki/Changes/ShadowStack
+adjust+:
+  - when: arch != x86_64
+    enabled: false
+    continue: false
+    because: Shadow Stack (Intel CET) is x86_64 only
+
+  # Shadow stack enabled only in RHEL 9.9+ and 10.3+ and F45+
+  # Centos Stream is RHEL upstream, available always.
+  # Not supported in RHEL-8 and older
+  - when: distro == rhel-9 and distro < rhel-9.9 or
+      distro == rhel-10 and distro < rhel-10.3 or
+      distro == fedora and distro < fedora-45 or
+      distro <= rhel-8
+    enabled: false
diff --git a/tests/Sanity/shadow-stack-smoke/runtest.sh b/tests/Sanity/shadow-stack-smoke/runtest.sh
new file mode 100755
index 0000000..103a7a2
--- /dev/null
+++ b/tests/Sanity/shadow-stack-smoke/runtest.sh
@@ -0,0 +1,40 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="$(rpm -qf $(which rustc))"
+PACKAGES=${PACKAGES:-$PACKAGE}
+
+# rustc must mark x86_64-unknown-linux-gnu output as Shadow Stack (SHSTK)
+# compatible by default, without any extra flags:
+# https://fedoraproject.org/wiki/Changes/ShadowStack
+# https://issues.redhat.com/browse/RHEL-213919
+TARGET="x86_64-unknown-linux-gnu"
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlAssertRpm --all
+        rlRun "tmp=\$(mktemp -d)" 0 "Create tmp directory"
+        rlRun "cp hello.rs $tmp"
+        rlRun "pushd $tmp"
+        rlRun "set -o pipefail"
+    rlPhaseEnd
+
+    rlPhaseStartTest "binary is marked SHSTK by default"
+        rlRun "rustc --target $TARGET hello.rs -o hello"
+        rlRun "./hello | grep 'Hello, world!'"
+        rlRun "readelf -n hello > hello-notes.out"
+        rlAssertGrep "SHSTK" hello-notes.out
+    rlPhaseEnd
+
+    rlPhaseStartTest "cdylib is marked SHSTK by default"
+        rlRun "rustc --target $TARGET --crate-type cdylib hello.rs -o libhello.so"
+        rlRun "readelf -n libhello.so > libhello-notes.out"
+        rlAssertGrep "SHSTK" libhello-notes.out
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "popd"
+        rlRun "rm -r $tmp" 0 "Remove tmp directory"
+    rlPhaseEnd
+rlJournalEnd