test(integration): add inotify family tracing coverage

Add an inotify-basic ioworkload scenario and an end-to-end integration
test covering the inotify IPC family, which previously had no integration
coverage (only inotify_init1 had a unit-level eventloop test).

The scenario issues inotify_init1(IN_CLOEXEC) -> inotify_add_watch on a
temp file (IN_CREATE|IN_DELETE|IN_MODIFY) -> inotify_rm_watch -> close.
It is non-blocking: it registers and removes the watch without reading
events, and cleans up the temp dir on return.

TestInotifyBasic asserts enter_inotify_init1, enter_inotify_add_watch,
enter_inotify_rm_watch and enter_close each fire at least once, with
positive durations and PID/comm hermetic guards. The init1 instance fd
resolves to the inotifyfd: path label; add_watch/rm_watch capture the
instance fd@arg0 which resolves to the same registered label.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

3 files changed, 91 insertions, 0 deletions

diff --git a/cmd/ioworkload/scenario_inotify.go b/cmd/ioworkload/scenario_inotify.go
new file mode 100644
index 0000000..770d0ff
--- /dev/null
+++ b/cmd/ioworkload/scenario_inotify.go
@@ -0,0 +1,57 @@
+package main
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"syscall"
+
+	"golang.org/x/sys/unix"
+)
+
+// inotifyBasic exercises the inotify IPC family end-to-end:
+// inotify_init1(IN_CLOEXEC) creates the inotify instance fd (registered as an
+// eventfd-kind descriptor, exit ret UNCLASSIFIED, path label "inotifyfd:"),
+// inotify_add_watch registers a watch on a file under a temp dir and returns a
+// watch descriptor (NOT a tracked fd; exit ret UNCLASSIFIED), inotify_rm_watch
+// removes that watch by descriptor, and close releases the instance fd.
+//
+// It is deliberately non-blocking: it only registers and removes the watch and
+// never reads pending events, so the workload returns promptly regardless of
+// filesystem activity. The watched path lives under a temp dir that is removed
+// on return.
+func inotifyBasic() error {
+	dir, cleanup, err := makeTempDir("inotify")
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	// Create a concrete file to watch so the path resolves to a real inode.
+	watched := filepath.Join(dir, "watched")
+	if err := os.WriteFile(watched, []byte("ior"), 0o600); err != nil {
+		return fmt.Errorf("create watched file: %w", err)
+	}
+
+	// inotify_init1 with IN_CLOEXEC; returns the inotify instance fd.
+	fd, err := unix.InotifyInit1(unix.IN_CLOEXEC)
+	if err != nil {
+		return fmt.Errorf("inotify_init1: %w", err)
+	}
+	defer syscall.Close(fd)
+
+	// inotify_add_watch on the instance fd; returns a watch descriptor (wd),
+	// which is NOT a file descriptor and must not be registered as a tracked fd.
+	mask := uint32(unix.IN_CREATE | unix.IN_DELETE | unix.IN_MODIFY)
+	wd, err := unix.InotifyAddWatch(fd, watched, mask)
+	if err != nil {
+		return fmt.Errorf("inotify_add_watch: %w", err)
+	}
+
+	// inotify_rm_watch removes the watch by descriptor on the instance fd.
+	if _, err := unix.InotifyRmWatch(fd, uint32(wd)); err != nil {
+		return fmt.Errorf("inotify_rm_watch: %w", err)
+	}
+
+	return nil
+}
diff --git a/cmd/ioworkload/scenarios.go b/cmd/ioworkload/scenarios.go
index 690386b..68dc3d0 100644
--- a/cmd/ioworkload/scenarios.go
+++ b/cmd/ioworkload/scenarios.go
@@ -42,6 +42,7 @@ var scenarios = map[string]func() error{
 	"eventfd-basic":                 eventfdBasic,
 	"eventfd2-basic":                eventfd2Basic,
 	"fd-from-air-eventfd-users":     fdFromAirEventfdUsers,
+	"inotify-basic":                 inotifyBasic,
 	"mq-posix-basic":                mqPosixBasic,
 	"sysv-shm-basic":                sysvShmBasic,
 	"sysv-msg-basic":                sysvMsgBasic,
diff --git a/integrationtests/ipc_test.go b/integrationtests/ipc_test.go
index 9c1efcc..8420b9b 100644
--- a/integrationtests/ipc_test.go
+++ b/integrationtests/ipc_test.go
@@ -9,6 +9,8 @@ const mqPayloadLen = uint64(14)
 
 var ipcDescriptorTraceArgs = []string{"-trace-syscalls", "pipe,pipe2,eventfd,eventfd2,close"}
 
+var inotifyTraceArgs = []string{"-trace-syscalls", "inotify_init1,inotify_add_watch,inotify_rm_watch,close"}
+
 func TestPipeBasic(t *testing.T) {
 	result, _ := runScenarioResultWithIorArgs(t, "pipe-basic", []ExpectedEvent{
 		{Tracepoint: "enter_pipe", MinCount: 1},
@@ -77,6 +79,37 @@ func TestFdFromAirEventfdUsers(t *testing.T) {
 	assertTracepointPathPrefix(t, result, "enter_timerfd_create", "timerfd:")
 }
 
+// TestInotifyBasic asserts end-to-end tracing of the inotify IPC family.
+// The inotify-basic scenario issues inotify_init1(IN_CLOEXEC) ->
+// inotify_add_watch(fd, file, IN_CREATE|IN_DELETE|IN_MODIFY) ->
+// inotify_rm_watch(fd, wd) -> close(fd). We assert all three inotify enter
+// tracepoints fire at least once, with positive durations and the hermetic
+// PID/comm guards already applied by runScenarioResultWithIorArgs. The
+// inotify_init1 instance fd resolves to the "inotifyfd:" path label, and the
+// close on that same fd carries the same label.
+func TestInotifyBasic(t *testing.T) {
+	result, _ := runScenarioResultWithIorArgs(t, "inotify-basic", []ExpectedEvent{
+		{Tracepoint: "enter_inotify_init1", MinCount: 1},
+		{Tracepoint: "enter_inotify_add_watch", MinCount: 1},
+		{Tracepoint: "enter_inotify_rm_watch", MinCount: 1},
+		{Tracepoint: "enter_close", MinCount: 1},
+	}, inotifyTraceArgs)
+
+	// inotify_init1 returns a registered fd labelled inotifyfd:, and the
+	// subsequent close of that fd resolves to the same tracked label.
+	assertTracepointPathPrefix(t, result, "enter_inotify_init1", "inotifyfd:")
+	assertTracepointPathPrefix(t, result, "enter_close", "inotifyfd:")
+
+	// inotify_add_watch / inotify_rm_watch capture the inotify instance fd
+	// (kind=fd@arg0), so they too resolve to the tracked inotifyfd: label.
+	assertTracepointPathPrefix(t, result, "enter_inotify_add_watch", "inotifyfd:")
+	assertTracepointPathPrefix(t, result, "enter_inotify_rm_watch", "inotifyfd:")
+
+	assertEventDurationPositive(t, result, ExpectedEvent{Tracepoint: "enter_inotify_init1", Comm: "ioworkload"})
+	assertEventDurationPositive(t, result, ExpectedEvent{Tracepoint: "enter_inotify_add_watch", Comm: "ioworkload"})
+	assertEventDurationPositive(t, result, ExpectedEvent{Tracepoint: "enter_inotify_rm_watch", Comm: "ioworkload"})
+}
+
 func TestPosixMqBasic(t *testing.T) {
 	enableParallelIfRequested(t)
 	h := newTestHarness(t)