Changes as suggested in the above inline comments.

Initialize nomask before dereferencing it

Correct the placement of

	/* Set local preselection audit_class as "no" for audit startup */
	set_preselect_mode(fd[0].fd, &nomask);

Improvements in some comments of set_preselect_mode function

• Include a perror("au_read_rec") for a better insight into incomplete audit record failure (If any)
• Remove redundant header sys/syscall.h
• Introduce a "no" audit class specifically for audit startup.

After a long period of debugging the incomplete audit record issue, which was fixed by D15381, this update introduces the following changes

Update the atf_tc_fail message for ppoll(2) timeout in check_auditpipe function to show the audit regex which caused the tests to fail (timeout).

• Remove ATF_REQUIRE condition from au_read_rec since reading extraneous corrupted records from auditpipe might not be successful always
• Call set_preselect_mode twice, once for audit startup and another for syscall audit
• print warning statement in case "au_fetch_tok" returns incomplete audit record

Remove if condition check from au_fetch_tok as it is possible that final audit tokens are not complete and are not required as well. There is no need to fail the tests in such scenario.

Add ATF_REQUIRE check on au_read_rec(3) function. Also, some formatting changes.

Revert back to using reclen-bytes as the third argument of au_fetch_tok instead of reclen to avoid buffer overrun.

Fix for the intermittent issue "failed: incomplete audit record". Also, clean any outstanding auditpipe buffer after audit startup is emitted from auditpipe

• Shift set_preselect_mode call post to "audit startup" as the tests failed when auditd(8) was already running.

Set of corrections in utils.c :

• Remove am_failure flag for "ad" audit class
• Remove extraneous boolean flag
• Shift set_preselect_mode to before audit startup to avoid race condition
• Additional changes in code sematics

• Fix the "audit startup" issue by looping within the "check_audit_startup" function to eliminate any unwanted events that might have been logged before audit startup.
• Define two wrapper functions check_audit_startup and check_audit around a static function check_auditpipe.

Remove the redundant line SRCS.file-create+= file-create.c from Makefile.

Revert the accidental addition of curly braces from single line if statements.

Replace spaces with tabs at a couple of places

Remove the braces for single line if statements according to style(9) from functions:

• FILE *setup
• static void set_preselect_mode

Update: Add the local preselection flag for non-attributable events
AUDITPIPE_SET_PRESELECT_NAFLAGS

Few corrections in the formatting of source program. The current changes did not seem to affect the result for me.

file-create:link_failure  ->  passed  [0.023s]
file-create:link_success  ->  passed  [0.022s]
file-create:linkat_failure  ->  passed  [0.023s]
file-create:linkat_success  ->  passed  [0.023s]
file-create:mkdir_failure  ->  passed  [0.024s]
file-create:mkdir_success  ->  passed  [0.026s]
file-create:mkdirat_failure  ->  passed  [0.026s]
file-create:mkdirat_success  ->  passed  [0.023s]
file-create:mkfifo_failure  ->  passed  [0.023s]
file-create:mkfifo_success  ->  passed  [0.028s]
file-create:mkfifoat_failure  ->  passed  [0.027s]
file-create:mkfifoat_success  ->  passed  [0.023s]
file-create:mknod_failure  ->  passed  [0.022s]
file-create:mknod_success  ->  passed  [0.022s]
file-create:mknodat_failure  ->  passed  [0.023s]
file-create:mknodat_success  ->  passed  [0.023s]
file-create:rename_failure  ->  passed  [0.022s]
file-create:rename_success  ->  passed  [0.023s]
file-create:renameat_failure  ->  passed  [0.023s]
file-create:renameat_success  ->  passed  [0.025s]
file-create:symlink_failure  ->  passed  [0.024s]
file-create:symlink_success  ->  passed  [0.023s]
file-create:symlinkat_failure  ->  passed  [0.025s]
file-create:symlinkat_success  ->  passed  [0.022s]

Set the test-case metadata "required_user" as root in Makefile:

TEST_METADATA.file-create+= required_user="root"

and remove atf_tc_set_md_var(tc, "require.user", "root"); from the head of individual test-case since each one of them require root user privileges

This diff introduces following changes:

• Rename setup.c/h to utils.c/h
• Introduce a new struct timespec variable timeout to keep track of remaining time while polling.
• Skip the tests in case the user is not root
• Remove BUFFLEN from utils.h and a few indentation fixes

Set of changes as requested by @asomers

• Sorted the header files, corrected 8 hard tab formatting and other changes according to style(9)
• Removed redundant type casting (const char *)
• Corrections in comments and valid variable naming.