// SPDX-License-Identifier: GPL-2.0
// Copyright (c) 2026 Christian Brauner <brauner@kernel.org>

#define _GNU_SOURCE
#include <errno.h>
#include <linux/types.h>
#include <poll.h>
#include <pthread.h>
#include <sched.h>
#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <syscall.h>
#include <sys/ioctl.h>
#include <sys/prctl.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <unistd.h>

#include "pidfd.h"
#include "kselftest_harness.h"

#ifndef CLONE_AUTOREAP
#define CLONE_AUTOREAP (1ULL << 34)
#endif

#ifndef CLONE_NNP
#define CLONE_NNP (1ULL << 35)
#endif

#ifndef CLONE_PIDFD_AUTOKILL
#define CLONE_PIDFD_AUTOKILL (1ULL << 36)
#endif

#ifndef _LINUX_CAPABILITY_VERSION_3
#define _LINUX_CAPABILITY_VERSION_3 0x20080522
#endif

struct cap_header {
	__u32 version;
	int pid;
};

struct cap_data {
	__u32 effective;
	__u32 permitted;
	__u32 inheritable;
};

static int drop_all_caps(void)
{
	struct cap_header hdr = { .version = _LINUX_CAPABILITY_VERSION_3 };
	struct cap_data data[2] = {};

	return syscall(__NR_capset, &hdr, data);
}

static pid_t create_autoreap_child(int *pidfd)
{
	struct __clone_args args = {
		.flags		= CLONE_PIDFD | CLONE_AUTOREAP,
		.exit_signal	= 0,
		.pidfd		= ptr_to_u64(pidfd),
	};

	return sys_clone3(&args, sizeof(args));
}

/*
 * Test that CLONE_AUTOREAP works without CLONE_PIDFD (fire-and-forget).
 */
TEST(autoreap_without_pidfd)
{
	struct __clone_args args = {
		.flags		= CLONE_AUTOREAP,
		.exit_signal	= 0,
	};
	pid_t pid;
	int ret;

	pid = sys_clone3(&args, sizeof(args));
	if (pid < 0 && errno == EINVAL)
		SKIP(return, "CLONE_AUTOREAP not supported");
	ASSERT_GE(pid, 0);

	if (pid == 0)
		_exit(0);

	/*
	 * Give the child a moment to exit and be autoreaped.
	 * Then verify no zombie remains.
	 */
	usleep(200000);
	ret = waitpid(pid, NULL, WNOHANG);
	ASSERT_EQ(ret, -1);
	ASSERT_EQ(errno, ECHILD);
}

/*
 * Test that CLONE_AUTOREAP with a non-zero exit_signal fails.
 */
TEST(autoreap_rejects_exit_signal)
{
	struct __clone_args args = {
		.flags		= CLONE_AUTOREAP,
		.exit_signal	= SIGCHLD,
	};
	pid_t pid;

	pid = sys_clone3(&args, sizeof(args));
	ASSERT_EQ(pid, -1);
	ASSERT_EQ(errno, EINVAL);
}

/*
 * Test that CLONE_AUTOREAP with CLONE_PARENT fails.
 */
TEST(autoreap_rejects_parent)
{
	struct __clone_args args = {
		.flags		= CLONE_AUTOREAP | CLONE_PARENT,
		.exit_signal	= 0,
	};
	pid_t pid;

	pid = sys_clone3(&args, sizeof(args));
	ASSERT_EQ(pid, -1);
	ASSERT_EQ(errno, EINVAL);
}

/*
 * Test that CLONE_AUTOREAP with CLONE_THREAD fails.
 */
TEST(autoreap_rejects_thread)
{
	struct __clone_args args = {
		.flags		= CLONE_AUTOREAP | CLONE_THREAD |
				  CLONE_SIGHAND | CLONE_VM,
		.exit_signal	= 0,
	};
	pid_t pid;

	pid = sys_clone3(&args, sizeof(args));
	ASSERT_EQ(pid, -1);
	ASSERT_EQ(errno, EINVAL);
}

/*
 * Basic test: create an autoreap child, let it exit, verify:
 * - pidfd becomes readable (poll returns POLLIN)
 * - PIDFD_GET_INFO returns the correct exit code
 * - waitpid() returns -1/ECHILD (no zombie)
 */
TEST(autoreap_basic)
{
	struct pidfd_info info = { .mask = PIDFD_INFO_EXIT };
	int pidfd = -1, ret;
	struct pollfd pfd;
	pid_t pid;

	pid = create_autoreap_child(&pidfd);
	if (pid < 0 && errno == EINVAL)
		SKIP(return, "CLONE_AUTOREAP not supported");
	ASSERT_GE(pid, 0);

	if (pid == 0)
		_exit(42);

	ASSERT_GE(pidfd, 0);

	/* Wait for the child to exit via pidfd poll. */
	pfd.fd = pidfd;
	pfd.events = POLLIN;
	ret = poll(&pfd, 1, 5000);
	ASSERT_EQ(ret, 1);
	ASSERT_TRUE(pfd.revents & POLLIN);

	/* Verify exit info via PIDFD_GET_INFO. */
	ret = ioctl(pidfd, PIDFD_GET_INFO, &info);
	ASSERT_EQ(ret, 0);
	ASSERT_TRUE(info.mask & PIDFD_INFO_EXIT);
	/*
	 * exit_code is in waitpid format: for _exit(42),
	 * WIFEXITED is true and WEXITSTATUS is 42.
	 */
	ASSERT_TRUE(WIFEXITED(info.exit_code));
	ASSERT_EQ(WEXITSTATUS(info.exit_code), 42);

	/* Verify no zombie: waitpid should fail with ECHILD. */
	ret = waitpid(pid, NULL, WNOHANG);
	ASSERT_EQ(ret, -1);
	ASSERT_EQ(errno, ECHILD);

	close(pidfd);
}

/*
 * Test that an autoreap child killed by a signal reports
 * the correct exit info.
 */
TEST(autoreap_signaled)
{
	struct pidfd_info info = { .mask = PIDFD_INFO_EXIT };
	int pidfd = -1, ret;
	struct pollfd pfd;
	pid_t pid;

	pid = create_autoreap_child(&pidfd);
	if (pid < 0 && errno == EINVAL)
		SKIP(return, "CLONE_AUTOREAP not supported");
	ASSERT_GE(pid, 0);

	if (pid == 0) {
		pause();
		_exit(1);
	}

	ASSERT_GE(pidfd, 0);

	/* Kill the child. */
	ret = sys_pidfd_send_signal(pidfd, SIGKILL, NULL, 0);
	ASSERT_EQ(ret, 0);

	/* Wait for exit via pidfd. */
	pfd.fd = pidfd;
	pfd.events = POLLIN;
	ret = poll(&pfd, 1, 5000);
	ASSERT_EQ(ret, 1);
	ASSERT_TRUE(pfd.revents & POLLIN);

	/* Verify signal info. */
	ret = ioctl(pidfd, PIDFD_GET_INFO, &info);
	ASSERT_EQ(ret, 0);
	ASSERT_TRUE(info.mask & PIDFD_INFO_EXIT);
	ASSERT_TRUE(WIFSIGNALED(info.exit_code));
	ASSERT_EQ(WTERMSIG(info.exit_code), SIGKILL);

	/* No zombie. */
	ret = waitpid(pid, NULL, WNOHANG);
	ASSERT_EQ(ret, -1);
	ASSERT_EQ(errno, ECHILD);

	close(pidfd);
}

/*
 * Test autoreap survives reparenting: middle process creates an
 * autoreap grandchild, then exits. The grandchild gets reparented
 * to us (the grandparent, which is a subreaper). When the grandchild
 * exits, it should still be autoreaped - no zombie under us.
 */
TEST(autoreap_reparent)
{
	int ipc_sockets[2], ret;
	int pidfd = -1;
	struct pollfd pfd;
	pid_t mid_pid, grandchild_pid;
	char buf[32] = {};

	/* Make ourselves a subreaper so reparented children come to us. */
	ret = prctl(PR_SET_CHILD_SUBREAPER, 1);
	ASSERT_EQ(ret, 0);

	ret = socketpair(AF_LOCAL, SOCK_STREAM | SOCK_CLOEXEC, 0, ipc_sockets);
	ASSERT_EQ(ret, 0);

	mid_pid = fork();
	ASSERT_GE(mid_pid, 0);

	if (mid_pid == 0) {
		/* Middle child: create an autoreap grandchild. */
		int gc_pidfd = -1;

		close(ipc_sockets[0]);

		grandchild_pid = create_autoreap_child(&gc_pidfd);
		if (grandchild_pid < 0) {
			write_nointr(ipc_sockets[1], "E", 1);
			close(ipc_sockets[1]);
			_exit(1);
		}

		if (grandchild_pid == 0) {
			/* Grandchild: wait for signal to exit. */
			close(ipc_sockets[1]);
			if (gc_pidfd >= 0)
				close(gc_pidfd);
			pause();
			_exit(0);
		}

		/* Send grandchild PID to grandparent. */
		snprintf(buf, sizeof(buf), "%d", grandchild_pid);
		write_nointr(ipc_sockets[1], buf, strlen(buf));
		close(ipc_sockets[1]);
		if (gc_pidfd >= 0)
			close(gc_pidfd);

		/* Middle child exits, grandchild gets reparented. */
		_exit(0);
	}

	close(ipc_sockets[1]);

	/* Read grandchild's PID. */
	ret = read_nointr(ipc_sockets[0], buf, sizeof(buf) - 1);
	close(ipc_sockets[0]);
	ASSERT_GT(ret, 0);

	if (buf[0] == 'E') {
		waitpid(mid_pid, NULL, 0);
		prctl(PR_SET_CHILD_SUBREAPER, 0);
		SKIP(return, "CLONE_AUTOREAP not supported");
	}

	grandchild_pid = atoi(buf);
	ASSERT_GT(grandchild_pid, 0);

	/* Wait for the middle child to exit. */
	ret = waitpid(mid_pid, NULL, 0);
	ASSERT_EQ(ret, mid_pid);

	/*
	 * Now the grandchild is reparented to us (subreaper).
	 * Open a pidfd for the grandchild and kill it.
	 */
	pidfd = sys_pidfd_open(grandchild_pid, 0);
	ASSERT_GE(pidfd, 0);

	ret = sys_pidfd_send_signal(pidfd, SIGKILL, NULL, 0);
	ASSERT_EQ(ret, 0);

	/* Wait for it to exit via pidfd poll. */
	pfd.fd = pidfd;
	pfd.events = POLLIN;
	ret = poll(&pfd, 1, 5000);
	ASSERT_EQ(ret, 1);
	ASSERT_TRUE(pfd.revents & POLLIN);

	/*
	 * The grandchild should have been autoreaped even though
	 * we (the new parent) haven't set SA_NOCLDWAIT.
	 * waitpid should return -1/ECHILD.
	 */
	ret = waitpid(grandchild_pid, NULL, WNOHANG);
	EXPECT_EQ(ret, -1);
	EXPECT_EQ(errno, ECHILD);

	close(pidfd);

	/* Clean up subreaper status. */
	prctl(PR_SET_CHILD_SUBREAPER, 0);
}

static int thread_sock_fd;

static void *thread_func(void *arg)
{
	/* Signal parent we're running. */
	write_nointr(thread_sock_fd, "1", 1);

	/* Give main thread time to call _exit() first. */
	usleep(200000);

	return NULL;
}

/*
 * Test that an autoreap child with multiple threads is properly
 * autoreaped only after all threads have exited.
 */
TEST(autoreap_multithreaded)
{
	struct pidfd_info info = { .mask = PIDFD_INFO_EXIT };
	int ipc_sockets[2], ret;
	int pidfd = -1;
	struct pollfd pfd;
	pid_t pid;
	char c;

	ret = socketpair(AF_LOCAL, SOCK_STREAM | SOCK_CLOEXEC, 0, ipc_sockets);
	ASSERT_EQ(ret, 0);

	pid = create_autoreap_child(&pidfd);
	if (pid < 0 && errno == EINVAL) {
		close(ipc_sockets[0]);
		close(ipc_sockets[1]);
		SKIP(return, "CLONE_AUTOREAP not supported");
	}
	ASSERT_GE(pid, 0);

	if (pid == 0) {
		pthread_t thread;

		close(ipc_sockets[0]);

		/*
		 * Create a sub-thread that outlives the main thread.
		 * The thread signals readiness, then sleeps.
		 * The main thread waits briefly, then calls _exit().
		 */
		thread_sock_fd = ipc_sockets[1];
		pthread_create(&thread, NULL, thread_func, NULL);
		pthread_detach(thread);

		/* Wait for thread to be running. */
		usleep(100000);

		/* Main thread exits; sub-thread is still alive. */
		_exit(99);
	}

	close(ipc_sockets[1]);

	/* Wait for the sub-thread to signal readiness. */
	ret = read_nointr(ipc_sockets[0], &c, 1);
	close(ipc_sockets[0]);
	ASSERT_EQ(ret, 1);

	/* Wait for the process to fully exit via pidfd poll. */
	pfd.fd = pidfd;
	pfd.events = POLLIN;
	ret = poll(&pfd, 1, 5000);
	ASSERT_EQ(ret, 1);
	ASSERT_TRUE(pfd.revents & POLLIN);

	/* Verify exit info. */
	ret = ioctl(pidfd, PIDFD_GET_INFO, &info);
	ASSERT_EQ(ret, 0);
	ASSERT_TRUE(info.mask & PIDFD_INFO_EXIT);
	ASSERT_TRUE(WIFEXITED(info.exit_code));
	ASSERT_EQ(WEXITSTATUS(info.exit_code), 99);

	/* No zombie. */
	ret = waitpid(pid, NULL, WNOHANG);
	ASSERT_EQ(ret, -1);
	ASSERT_EQ(errno, ECHILD);

	close(pidfd);
}

/*
 * Test that autoreap is NOT inherited by grandchildren.
 */
TEST(autoreap_no_inherit)
{
	int ipc_sockets[2], ret;
	int pidfd = -1;
	pid_t pid;
	char buf[2] = {};
	struct pollfd pfd;

	ret = socketpair(AF_LOCAL, SOCK_STREAM | SOCK_CLOEXEC, 0, ipc_sockets);
	ASSERT_EQ(ret, 0);

	pid = create_autoreap_child(&pidfd);
	if (pid < 0 && errno == EINVAL) {
		close(ipc_sockets[0]);
		close(ipc_sockets[1]);
		SKIP(return, "CLONE_AUTOREAP not supported");
	}
	ASSERT_GE(pid, 0);

	if (pid == 0) {
		pid_t gc;
		int status;

		close(ipc_sockets[0]);

		/* Autoreap child forks a grandchild (without autoreap). */
		gc = fork();
		if (gc < 0) {
			write_nointr(ipc_sockets[1], "E", 1);
			_exit(1);
		}
		if (gc == 0) {
			/* Grandchild: exit immediately. */
			close(ipc_sockets[1]);
			_exit(77);
		}

		/*
		 * The grandchild should become a regular zombie
		 * since it was NOT created with CLONE_AUTOREAP.
		 * Wait for it to verify.
		 */
		ret = waitpid(gc, &status, 0);
		if (ret == gc && WIFEXITED(status) &&
		    WEXITSTATUS(status) == 77) {
			write_nointr(ipc_sockets[1], "P", 1);
		} else {
			write_nointr(ipc_sockets[1], "F", 1);
		}
		close(ipc_sockets[1]);
		_exit(0);
	}

	close(ipc_sockets[1]);

	ret = read_nointr(ipc_sockets[0], buf, 1);
	close(ipc_sockets[0]);
	ASSERT_EQ(ret, 1);

	/*
	 * 'P' means the autoreap child was able to waitpid() its
	 * grandchild (correct - grandchild should be a normal zombie,
	 * not autoreaped).
	 */
	ASSERT_EQ(buf[0], 'P');

	/* Wait for the autoreap child to exit. */
	pfd.fd = pidfd;
	pfd.events = POLLIN;
	ret = poll(&pfd, 1, 5000);
	ASSERT_EQ(ret, 1);

	/* Autoreap child itself should be autoreaped. */
	ret = waitpid(pid, NULL, WNOHANG);
	ASSERT_EQ(ret, -1);
	ASSERT_EQ(errno, ECHILD);

	close(pidfd);
}

/*
 * Test that CLONE_NNP sets no_new_privs on the child.
 * The child checks via prctl(PR_GET_NO_NEW_PRIVS) and reports back.
 * The parent must NOT have no_new_privs set afterwards.
 */
TEST(nnp_sets_no_new_privs)
{
	struct __clone_args args = {
		.flags		= CLONE_PIDFD | CLONE_AUTOREAP | CLONE_NNP,
		.exit_signal	= 0,
	};
	struct pidfd_info info = { .mask = PIDFD_INFO_EXIT };
	int pidfd = -1, ret;
	struct pollfd pfd;
	pid_t pid;

	/* Ensure parent does not already have no_new_privs. */
	ret = prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0);
	ASSERT_EQ(ret, 0) {
		TH_LOG("Parent already has no_new_privs set, cannot run test");
	}

	args.pidfd = ptr_to_u64(&pidfd);

	pid = sys_clone3(&args, sizeof(args));
	if (pid < 0 && errno == EINVAL)
		SKIP(return, "CLONE_NNP not supported");
	ASSERT_GE(pid, 0);

	if (pid == 0) {
		/*
		 * Child: check no_new_privs. Exit 0 if set, 1 if not.
		 */
		ret = prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0);
		_exit(ret == 1 ? 0 : 1);
	}

	ASSERT_GE(pidfd, 0);

	/* Parent must still NOT have no_new_privs. */
	ret = prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0);
	ASSERT_EQ(ret, 0) {
		TH_LOG("Parent got no_new_privs after creating CLONE_NNP child");
	}

	/* Wait for child to exit. */
	pfd.fd = pidfd;
	pfd.events = POLLIN;
	ret = poll(&pfd, 1, 5000);
	ASSERT_EQ(ret, 1);

	/* Verify child exited with 0 (no_new_privs was set). */
	ret = ioctl(pidfd, PIDFD_GET_INFO, &info);
	ASSERT_EQ(ret, 0);
	ASSERT_TRUE(info.mask & PIDFD_INFO_EXIT);
	ASSERT_TRUE(WIFEXITED(info.exit_code));
	ASSERT_EQ(WEXITSTATUS(info.exit_code), 0) {
		TH_LOG("Child did not have no_new_privs set");
	}

	close(pidfd);
}

/*
 * Test that CLONE_NNP with CLONE_THREAD fails with EINVAL.
 */
TEST(nnp_rejects_thread)
{
	struct __clone_args args = {
		.flags		= CLONE_NNP | CLONE_THREAD |
				  CLONE_SIGHAND | CLONE_VM,
		.exit_signal	= 0,
	};
	pid_t pid;

	pid = sys_clone3(&args, sizeof(args));
	ASSERT_EQ(pid, -1);
	ASSERT_EQ(errno, EINVAL);
}

/*
 * Test that a plain CLONE_AUTOREAP child does NOT get no_new_privs.
 * Only CLONE_NNP should set it.
 */
TEST(autoreap_no_new_privs_unset)
{
	struct pidfd_info info = { .mask = PIDFD_INFO_EXIT };
	int pidfd = -1, ret;
	struct pollfd pfd;
	pid_t pid;

	pid = create_autoreap_child(&pidfd);
	if (pid < 0 && errno == EINVAL)
		SKIP(return, "CLONE_AUTOREAP not supported");
	ASSERT_GE(pid, 0);

	if (pid == 0) {
		/*
		 * Child: check no_new_privs. Exit 0 if NOT set, 1 if set.
		 */
		ret = prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0);
		_exit(ret == 0 ? 0 : 1);
	}

	ASSERT_GE(pidfd, 0);

	pfd.fd = pidfd;
	pfd.events = POLLIN;
	ret = poll(&pfd, 1, 5000);
	ASSERT_EQ(ret, 1);

	ret = ioctl(pidfd, PIDFD_GET_INFO, &info);
	ASSERT_EQ(ret, 0);
	ASSERT_TRUE(info.mask & PIDFD_INFO_EXIT);
	ASSERT_TRUE(WIFEXITED(info.exit_code));
	ASSERT_EQ(WEXITSTATUS(info.exit_code), 0) {
		TH_LOG("Plain autoreap child unexpectedly has no_new_privs");
	}

	close(pidfd);
}

/*
 * Helper: create a child with CLONE_PIDFD | CLONE_PIDFD_AUTOKILL | CLONE_AUTOREAP | CLONE_NNP.
 */
static pid_t create_autokill_child(int *pidfd)
{
	struct __clone_args args = {
		.flags		= CLONE_PIDFD | CLONE_PIDFD_AUTOKILL |
				  CLONE_AUTOREAP | CLONE_NNP,
		.exit_signal	= 0,
		.pidfd		= ptr_to_u64(pidfd),
	};

	return sys_clone3(&args, sizeof(args));
}

/*
 * Basic autokill test: child blocks in pause(), parent closes the
 * clone3 pidfd, child should be killed and autoreaped.
 */
TEST(autokill_basic)
{
	int pidfd = -1, pollfd_fd = -1, ret;
	struct pollfd pfd;
	pid_t pid;

	pid = create_autokill_child(&pidfd);
	if (pid < 0 && errno == EINVAL)
		SKIP(return, "CLONE_PIDFD_AUTOKILL not supported");
	ASSERT_GE(pid, 0);

	if (pid == 0) {
		pause();
		_exit(1);
	}

	ASSERT_GE(pidfd, 0);

	/*
	 * Open a second pidfd via pidfd_open() so we can observe the
	 * child's death after closing the clone3 pidfd.
	 */
	pollfd_fd = sys_pidfd_open(pid, 0);
	ASSERT_GE(pollfd_fd, 0);

	/* Close the clone3 pidfd — this should trigger autokill. */
	close(pidfd);

	/* Wait for the child to die via the pidfd_open'd fd. */
	pfd.fd = pollfd_fd;
	pfd.events = POLLIN;
	ret = poll(&pfd, 1, 5000);
	ASSERT_EQ(ret, 1);
	ASSERT_TRUE(pfd.revents & POLLIN);

	/* Child should be autoreaped — no zombie. */
	usleep(100000);
	ret = waitpid(pid, NULL, WNOHANG);
	ASSERT_EQ(ret, -1);
	ASSERT_EQ(errno, ECHILD);

	close(pollfd_fd);
}

/*
 * CLONE_PIDFD_AUTOKILL without CLONE_PIDFD must fail with EINVAL.
 */
TEST(autokill_requires_pidfd)
{
	struct __clone_args args = {
		.flags		= CLONE_PIDFD_AUTOKILL | CLONE_AUTOREAP,
		.exit_signal	= 0,
	};
	pid_t pid;

	pid = sys_clone3(&args, sizeof(args));
	ASSERT_EQ(pid, -1);
	ASSERT_EQ(errno, EINVAL);
}

/*
 * CLONE_PIDFD_AUTOKILL without CLONE_AUTOREAP must fail with EINVAL.
 */
TEST(autokill_requires_autoreap)
{
	int pidfd = -1;
	struct __clone_args args = {
		.flags		= CLONE_PIDFD | CLONE_PIDFD_AUTOKILL,
		.exit_signal	= 0,
		.pidfd		= ptr_to_u64(&pidfd),
	};
	pid_t pid;

	pid = sys_clone3(&args, sizeof(args));
	ASSERT_EQ(pid, -1);
	ASSERT_EQ(errno, EINVAL);
}

/*
 * CLONE_PIDFD_AUTOKILL with CLONE_THREAD must fail with EINVAL.
 */
TEST(autokill_rejects_thread)
{
	int pidfd = -1;
	struct __clone_args args = {
		.flags		= CLONE_PIDFD | CLONE_PIDFD_AUTOKILL |
				  CLONE_AUTOREAP | CLONE_THREAD |
				  CLONE_SIGHAND | CLONE_VM,
		.exit_signal	= 0,
		.pidfd		= ptr_to_u64(&pidfd),
	};
	pid_t pid;

	pid = sys_clone3(&args, sizeof(args));
	ASSERT_EQ(pid, -1);
	ASSERT_EQ(errno, EINVAL);
}

/*
 * Test that only the clone3 pidfd triggers autokill, not pidfd_open().
 * Close the pidfd_open'd fd first — child should survive.
 * Then close the clone3 pidfd — child should be killed and autoreaped.
 */
TEST(autokill_pidfd_open_no_effect)
{
	int pidfd = -1, open_fd = -1, ret;
	struct pollfd pfd;
	pid_t pid;

	pid = create_autokill_child(&pidfd);
	if (pid < 0 && errno == EINVAL)
		SKIP(return, "CLONE_PIDFD_AUTOKILL not supported");
	ASSERT_GE(pid, 0);

	if (pid == 0) {
		pause();
		_exit(1);
	}

	ASSERT_GE(pidfd, 0);

	/* Open a second pidfd via pidfd_open(). */
	open_fd = sys_pidfd_open(pid, 0);
	ASSERT_GE(open_fd, 0);

	/*
	 * Close the pidfd_open'd fd — child should survive because
	 * only the clone3 pidfd has autokill.
	 */
	close(open_fd);
	usleep(200000);

	/* Verify child is still alive by polling the clone3 pidfd. */
	pfd.fd = pidfd;
	pfd.events = POLLIN;
	ret = poll(&pfd, 1, 0);
	ASSERT_EQ(ret, 0) {
		TH_LOG("Child died after closing pidfd_open fd — should still be alive");
	}

	/* Open another observation fd before triggering autokill. */
	open_fd = sys_pidfd_open(pid, 0);
	ASSERT_GE(open_fd, 0);

	/* Now close the clone3 pidfd — this triggers autokill. */
	close(pidfd);

	pfd.fd = open_fd;
	pfd.events = POLLIN;
	ret = poll(&pfd, 1, 5000);
	ASSERT_EQ(ret, 1);
	ASSERT_TRUE(pfd.revents & POLLIN);

	/* Child should be autoreaped — no zombie. */
	usleep(100000);
	ret = waitpid(pid, NULL, WNOHANG);
	ASSERT_EQ(ret, -1);
	ASSERT_EQ(errno, ECHILD);

	close(open_fd);
}

/*
 * Test that CLONE_PIDFD_AUTOKILL without CLONE_NNP fails with EPERM
 * for an unprivileged caller.
 */
TEST(autokill_requires_cap_sys_admin)
{
	int pidfd = -1, ret;
	struct __clone_args args = {
		.flags		= CLONE_PIDFD | CLONE_PIDFD_AUTOKILL |
				  CLONE_AUTOREAP,
		.exit_signal	= 0,
		.pidfd		= ptr_to_u64(&pidfd),
	};
	pid_t pid;

	/* Drop all capabilities so we lack CAP_SYS_ADMIN. */
	ret = drop_all_caps();
	ASSERT_EQ(ret, 0);

	pid = sys_clone3(&args, sizeof(args));
	ASSERT_EQ(pid, -1);
	ASSERT_EQ(errno, EPERM);
}

/*
 * Test that CLONE_PIDFD_AUTOKILL without CLONE_NNP succeeds with
 * CAP_SYS_ADMIN.
 */
TEST(autokill_without_nnp_with_cap)
{
	struct __clone_args args = {
		.flags		= CLONE_PIDFD | CLONE_PIDFD_AUTOKILL |
				  CLONE_AUTOREAP,
		.exit_signal	= 0,
	};
	struct pidfd_info info = { .mask = PIDFD_INFO_EXIT };
	int pidfd = -1, ret;
	struct pollfd pfd;
	pid_t pid;

	if (geteuid() != 0)
		SKIP(return, "Need root/CAP_SYS_ADMIN");

	args.pidfd = ptr_to_u64(&pidfd);

	pid = sys_clone3(&args, sizeof(args));
	if (pid < 0 && errno == EINVAL)
		SKIP(return, "CLONE_PIDFD_AUTOKILL not supported");
	ASSERT_GE(pid, 0);

	if (pid == 0)
		_exit(0);

	ASSERT_GE(pidfd, 0);

	/* Wait for child to exit. */
	pfd.fd = pidfd;
	pfd.events = POLLIN;
	ret = poll(&pfd, 1, 5000);
	ASSERT_EQ(ret, 1);

	ret = ioctl(pidfd, PIDFD_GET_INFO, &info);
	ASSERT_EQ(ret, 0);
	ASSERT_TRUE(info.mask & PIDFD_INFO_EXIT);
	ASSERT_TRUE(WIFEXITED(info.exit_code));
	ASSERT_EQ(WEXITSTATUS(info.exit_code), 0);

	close(pidfd);
}

TEST_HARNESS_MAIN