test: add coverage for mknodat and ioprio_get/ioprio_set

Add end-to-end integration scenarios and tests for two previously
untested syscalls:

- mknodat(2): new dir-mknodat-fifo scenario creates an unprivileged
  FIFO node (S_IFIFO, no CAP_MKNOD) via unix.Mknodat under AT_FDCWD
  and unlinks it. TestDirMknodatFifo asserts enter_mknodat fires with
  pathname@args[1] (after dirfd@args[0]), proven by a PathContains
  match on the distinct fifo name, mirroring the mkdirat coverage.

- ioprio_get(2)/ioprio_set(2): new ioprio-basic scenario (the
  I/O-priority analogues of getpriority/setpriority) issues the raw
  syscalls (no x/sys wrapper exists), reading the current self I/O
  priority and re-applying it, or a harmless unprivileged best-effort
  value when none is set. TestIoprioBasic asserts enter_ioprio_get and
  enter_ioprio_set fire (null enters, UNCLASSIFIED ret), mirroring
  priority-basic. Realtime class is deliberately avoided as it needs
  CAP_SYS_ADMIN.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2 files changed, 46 insertions, 0 deletions

diff --git a/integrationtests/dir_test.go b/integrationtests/dir_test.go
index d759abd..bbcc3fe 100644
--- a/integrationtests/dir_test.go
+++ b/integrationtests/dir_test.go
@@ -24,6 +24,22 @@ func TestDirMkdirat(t *testing.T) {
 	})
 }
 
+// TestDirMknodatFifo verifies mknodat(2) is traced end-to-end. The
+// dir-mknodat-fifo workload creates an unprivileged FIFO node under AT_FDCWD,
+// so enter_mknodat fires with pathname@args[1] (after dirfd@args[0]). Matching
+// the distinct fifo name via PathContains proves the args[1] capture, mirroring
+// the mkdirat coverage above.
+func TestDirMknodatFifo(t *testing.T) {
+	runScenario(t, "dir-mknodat-fifo", []ExpectedEvent{
+		{
+			PathContains: "mknodat-fifo",
+			Tracepoint:   "enter_mknodat",
+			Comm:         "ioworkload",
+			MinCount:     1,
+		},
+	})
+}
+
 func TestDirChdir(t *testing.T) {
 	runScenario(t, "dir-chdir", []ExpectedEvent{
 		{
diff --git a/integrationtests/priority_test.go b/integrationtests/priority_test.go
index 9e41185..670aa8c 100644
--- a/integrationtests/priority_test.go
+++ b/integrationtests/priority_test.go
@@ -31,3 +31,33 @@ func TestPriorityBasic(t *testing.T) {
 		{Tracepoint: "enter_setpriority", Comm: "ioworkload", MinCount: 1},
 	})
 }
+
+// ioprioTraceArgs restricts tracing to the two I/O-priority syscalls the
+// ioprio-basic workload issues. Each tracepoint is named after the underlying
+// kernel syscall, so the names below match verbatim.
+var ioprioTraceArgs = []string{"-trace-syscalls", "ioprio_get,ioprio_set"}
+
+// TestIoprioBasic verifies the ioprio_get/ioprio_set pair (the I/O-priority
+// analogues of getpriority/setpriority) is traced end-to-end. The ioprio-basic
+// workload self-targets both calls (IOPRIO_WHO_PROCESS, who 0 == the calling
+// process): it reads the current I/O priority with ioprio_get and re-applies it
+// (or a harmless best-effort default when none is set) with ioprio_set, so no
+// other process is affected and no privilege is required. Both syscalls classify
+// as FamilyProcess with a KindNull enter (IOPRIO_WHO_PROCESS is an opcode, not an
+// fd) and an UNCLASSIFIED return (the value is an I/O-priority word, not a byte
+// count), so asserting the enter tracepoints appear — attributed to the
+// ioworkload process — is the right end-to-end check.
+func TestIoprioBasic(t *testing.T) {
+	h := newTestHarness(t)
+	result, pid, err := h.RunWithIorArgs("ioprio-basic", defaultDuration, ioprioTraceArgs)
+	if err != nil {
+		t.Fatalf("run scenario ioprio-basic: %v", err)
+	}
+
+	AssertNoUnexpectedPID(t, result, pid)
+	AssertNoUnexpectedComm(t, result, "ioworkload")
+	AssertEventsPresent(t, result, []ExpectedEvent{
+		{Tracepoint: "enter_ioprio_get", Comm: "ioworkload", MinCount: 1},
+		{Tracepoint: "enter_ioprio_set", Comm: "ioworkload", MinCount: 1},
+	})
+}