If every single test case needs to run as root, then you can simply put this line in your Makefile, and leave out all of the "require.user" lines from your test program's source:

TEST_METADATA.file-create+= required_user="root"

Misindentation

misindentation

This line has spaces instead of tabs. There are a few others that do, too. You must use tabs throughout.

Misindentation

Standard style(9) says that single-line if statements don't get curly braces. There are exceptions where the braces are needed for clariy, like if the else statement is multiline, or if there's a long comment above the single line. But those exceptions mostly don't apply in this file.

This change seems to have fixed the intermittency problems.

spaces -> tabs

spaces -> tabs

Why did you add all the curly braces back in?

This line is failing because "audit startup" is not necessarily the first event to come out of the audit pipe. You should loop here, just as you do in check_audit

Probably don't need the am_failure line.

You should choose a more descriptive name for the flag variable.

style(9) actually says that for(;;) is preferred over while (true)

A more idiomatic way to do this would be to use an endless loop and a break statement.

It would probably make sense just to move the cleanup steps into check_audit, and dispense with the flag for check_auditpipe

set_preselect_mode must be called before starting auditd. Otherwise there's a race.

This change looks wrong to me. Can you explain it?

In a case when reclen - bytes < token.len we would not have the entire audit token which looked as if it caused the "incomplete audit record" issue.
Also, why subtract bytes from reclen if there is a chance we might miss some records? Letting it be reclen seems to ensure that complete tokens are read.

Oh, apologies. I somehow edited different file than the one present in tests/sys/audit

au_fetch_tok's man page says that reclen is supposed to be the length of the supplied buffer. When bytes > 0, the buffer you're actually passing will be smaller than reclen.

I switched back to reclen - bytes from reclen and the intermittent issue seems to recur after a while. My take is, subtracting bytes from the original reclen causes the len parameter to eventually become less than token.len in some test-cases, which causes "incomplete audit record" issue

Also, since I'm comparing against a regex which includes return,success/failure which is essentially at the end of the audit record, this might explain why some time the tests timeout. (As this part of the regex would be absent from buffer)

No, the token must be completely contained within the buffer (where else would it be?). And the third argument to au_fetch_tok *must* be the length of the buffer. It's never ok to overrun a buffer.

This error message isn't quite right. Auditpipe may have returned something, just not what we were looking for. Also, the error message does not indicate whether we we missed the audit record for the syscall under test, or whether we failed to observe auditd startup. Could you please make that more clear? It looks to me like most if not all remaining test failures are due to missing auditd startup.

Why include this header?

You should also print errno here. You can do it like this:

perror("au_read_rec");
atf_tc_fail("Incomplete audit record")

This will probably work in the default case. However, if somebody has enabled too many classes in /etc/security/audit_control, then the audit queue might overflow before getting the audit startup message. To prevent that, you can set the audit class before starting auditd.

Don't dereference an uninitialized variable.

Why do you need this line?

If you're going to take the approach of having one file per audit class, then you may as well make the audit class a constant.

You should check for failure of both fmemopen and au_read_rec.

80 characters per line

s/an unknown event/too many file descriptors/

80 characters per line

This line would be a little bit faster if you move the check from sh to C by using atf_utils_file_exists.