Sandbox: tests for fcntl's notification rules and the new probe

crates/sandbox/src/linux.rs

@@ -403,6 +403,9 @@ mod tests {
     #[test]
     fn the_calls_that_reach_another_process_have_rules() {
         let rules = main_rules(4242).unwrap();
+        // `fcntl`'s notification commands: naming the owner to notify, both ways, choosing its
+        // signal, and the switch itself.
+        assert_eq!(rules.get(&libc::SYS_fcntl).map(Vec::len), Some(4), "the asynchronous-notification commands");
         for nr in [
             libc::SYS_kill,
             libc::SYS_tkill,

crates/sandbox/src/probe.rs

@@ -232,6 +232,15 @@ mod tests {
         }
     }
 
+    /// Unconfined, the notification probe reports what the system allows; confined, the launch
+    /// check needs it `Denied`. Either way it comes out of the same three calls, so this proves
+    /// the probe runs and classifies rather than failing outright.
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn the_notification_probe_classifies() {
+        assert!(matches!(async_probe(), Outcome::Allowed(_)), "unconfined the switch can be set");
+    }
+
     #[test]
     fn the_checks_on_the_canary_change_nothing_where_they_are_allowed() {
         let canary = crate::Canary::create().unwrap();