From cd516e1577ad97d5c8b1603657b13d110557e1b2 Mon Sep 17 00:00:00 2001
From: Paul Buetow <paul@buetow.org>
Date: Sat, 21 Feb 2026 20:53:07 +0200
Subject: Add negative integration tests for open syscalls

- openEnoent: verifies ior captures enter_openat even when syscall fails (ENOENT)
- openRdonlyWrite: verifies tracing of open + failed write to read-only fd
- openPidFilter: verifies child process I/O is excluded by PID filtering
- AssertEventsAbsent helper with zero-value guard and 6 unit tests

Task: 348
Amp-Thread-ID: https://ampcode.com/threads/T-019c8185-55f4-72f0-8ddb-3be5e4002c0d
Co-authored-by: Amp <amp@ampcode.com>
---
 integrationtests/open_test.go | 56 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 56 insertions(+)

(limited to 'integrationtests/open_test.go')

diff --git a/integrationtests/open_test.go b/integrationtests/open_test.go
index 917ce79..8dfbba6 100644
--- a/integrationtests/open_test.go
+++ b/integrationtests/open_test.go
@@ -34,3 +34,59 @@ func TestOpenByHandleAt(t *testing.T) {
 		},
 	})
 }
+
+func TestOpenEnoent(t *testing.T) {
+	runScenario(t, "open-enoent", []ExpectedEvent{
+		{
+			PathContains: "enoentfile.txt",
+			Tracepoint:   "enter_openat",
+			Comm:         "ioworkload",
+			MinCount:     1,
+		},
+	})
+}
+
+func TestOpenRdonlyWrite(t *testing.T) {
+	runScenario(t, "open-rdonly-write", []ExpectedEvent{
+		{
+			PathContains: "rdonlyfile.txt",
+			Tracepoint:   "enter_openat",
+			Comm:         "ioworkload",
+			MinCount:     1,
+		},
+		{
+			PathContains: "rdonlyfile.txt",
+			Tracepoint:   "enter_write",
+			Comm:         "ioworkload",
+			MinCount:     1,
+		},
+	})
+}
+
+func TestOpenPidFilter(t *testing.T) {
+	h := newTestHarness(t)
+	result, pid, err := h.Run("open-pid-filter", defaultDuration)
+	if err != nil {
+		t.Fatalf("run scenario open-pid-filter: %v", err)
+	}
+
+	AssertNoUnexpectedPID(t, result, pid)
+	AssertNoUnexpectedComm(t, result, "ioworkload")
+
+	// Parent's file should be captured.
+	AssertEventsPresent(t, result, []ExpectedEvent{
+		{
+			PathContains: "parentfile.txt",
+			Tracepoint:   "enter_openat",
+			Comm:         "ioworkload",
+			MinCount:     1,
+		},
+	})
+
+	// Child's file should NOT be captured (different PID).
+	AssertEventsAbsent(t, result, []ExpectedEvent{
+		{
+			PathContains: "childfile.txt",
+		},
+	})
+}
-- 
cgit v1.2.3