[PATCH] mv: don't block when setting the SELinux security context on a FIFO

[Collin Funk]

I'm leaning towards this being considered a bug because I suspect it
wasn't intended to block here. But I could see it being considered an
improvement as well.

-- 8< --

* src/selinux.c (restorecon_private): Open the file with O_NOCTTY and
O_NONBLOCK.
* tests/misc/selinux.sh: Add a test case.
* NEWS: Mention the bug fix.

Discovered by Anthropic's OSS Scanner, as bug ANT-2026-L5GJ7M7X.
---
 NEWS                  | 4 ++++
 src/selinux.c         | 2 +-
 tests/misc/selinux.sh | 2 ++
 3 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/NEWS b/NEWS
index b964fd135..275140f89 100644
--- a/NEWS
+++ b/NEWS
@@ -39,6 +39,10 @@ GNU coreutils NEWS                                    -*- 
outline -*-
   lookup on a file without an ACL.
   [bug introduced in coreutils-9.6]
 
+  'mv -Z' no longer blocks when setting the SELinux security context of a
+  just-moved FIFO.
+  [bug introduced with SELinux support in coreutils-8.22]
+
   'realpath' without -s, or 'readlink' with -e,-f,-m no longer
   loop infinitely when resolving a symbolic link which
   resolves to a path beginning with the symbolic link itself.
diff --git a/src/selinux.c b/src/selinux.c
index 17103caa0..e5f5e14bb 100644
--- a/src/selinux.c
+++ b/src/selinux.c
@@ -202,7 +202,7 @@ restorecon_private (struct selabel_handle *selabel_handle, 
char const *path)
       return rc;
     }
 
-  fd = open (path, O_RDONLY | O_NOFOLLOW);
+  fd = open (path, O_RDONLY | O_NOFOLLOW | O_NOCTTY | O_NONBLOCK);
   if (fd == -1 && (errno != ELOOP))
     goto quit;
 
diff --git a/tests/misc/selinux.sh b/tests/misc/selinux.sh
index 627b5dc30..74f88fb86 100755
--- a/tests/misc/selinux.sh
+++ b/tests/misc/selinux.sh
@@ -62,4 +62,6 @@ for i in d f p; do
   c=$(stat --printf %C s2/$i); test x$c = x$ctx || fail=1
 done
 
+timeout 10 mv -Z s2/p s1 || fail=1
+
 Exit $fail
-- 
2.56.0