From: Christoph Hellwig <hch@lst.de>
Date: Mon, 26 Jan 2026 13:08:43 +0000 (+0100)
Subject: generic: test that truncate(2) on fsverity is blocked
X-Git-Tag: v2026.02.26~10
X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=1ec21c2911f39b4aa3bb21d5560f1b6da72b0b5e;p=xfstests-dev.git

generic: test that truncate(2) on fsverity is blocked

truncate(2) doesn't go through open and needs special code to block
it on fsverity files.  btrfs was missing this check.

Note that truncate(2) in current core utils uses openat and ftruncate,
so add our own little test program for it.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Zorro Lang <zlang@redhat.com>
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Zorro Lang <zlang@kernel.org>
---

diff --git a/.gitignore b/.gitignore
index 82c57f41..2b5bedd5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -212,6 +212,7 @@ tags
 /src/dio-writeback-race
 /src/unlink-fsync
 /src/file_attr
+/src/truncate
 
 # Symlinked files
 /tests/generic/035.out
diff --git a/src/Makefile b/src/Makefile
index d0a4106e..577d816a 100644
--- a/src/Makefile
+++ b/src/Makefile
@@ -21,7 +21,7 @@ TARGETS = dirstress fill fill2 getpagesize holes lstat64 \
 	t_mmap_writev_overlap checkpoint_journal mmap-rw-fault allocstale \
 	t_mmap_cow_memory_failure fake-dump-rootino dio-buf-fault rewinddir-test \
 	readdir-while-renames dio-append-buf-fault dio-write-fsync-same-fd \
-	dio-writeback-race unlink-fsync
+	dio-writeback-race unlink-fsync truncate
 
 LINUX_TARGETS = xfsctl bstat t_mtab getdevicesize preallo_rw_pattern_reader \
 	preallo_rw_pattern_writer ftrunc trunc fs_perms testx looptest \
diff --git a/src/truncate.c b/src/truncate.c
new file mode 100644
index 00000000..4c106d26
--- /dev/null
+++ b/src/truncate.c
@@ -0,0 +1,17 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2026 Christoph Hellwig.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+int main(int argc, char **argv)
+{
+	if (truncate(argv[1], 0) < 0) {
+		perror("truncate");
+		exit(1);
+	}
+
+	fprintf(stderr, "truncate succeeded\n");
+}
diff --git a/tests/generic/788 b/tests/generic/788
new file mode 100755
index 00000000..ac4720d7
--- /dev/null
+++ b/tests/generic/788
@@ -0,0 +1,38 @@
+#! /bin/bash
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2026 Christoph Hellwig.
+#
+# FS QA Test 788
+#
+# Test that truncate(2) is blocked on fsverity files.
+#
+. ./common/preamble
+_begin_fstest auto quick verity
+
+_cleanup()
+{
+	cd /
+	_restore_fsverity_signatures
+	rm -f $tmp.*
+}
+
+. ./common/filter
+. ./common/verity
+
+_require_scratch_verity
+_require_test_program "truncate"
+
+_disable_fsverity_signatures
+
+_scratch_mkfs_verity &>> $seqres.full
+_scratch_mount
+
+fsv_file=$SCRATCH_MNT/file.fsv
+
+_fsv_scratch_begin_subtest "Using truncate(2) on a verity file fails"
+_fsv_create_enable_file $fsv_file
+$here/src/truncate $fsv_file
+
+# success, all done
+status=0
+exit
diff --git a/tests/generic/788.out b/tests/generic/788.out
new file mode 100644
index 00000000..11074b71
--- /dev/null
+++ b/tests/generic/788.out
@@ -0,0 +1,4 @@
+QA output created by 788
+
+# Using truncate(2) on a verity file fails
+truncate: Operation not permitted