mv: don't block when setting the SELinux security context on a FIFO

* src/selinux.c (restorecon_private): Open the file with O_NOCTTY and
O_NONBLOCK.
* tests/misc/selinux.sh: Add a test case.
* NEWS: Mention the bug fix.

Discovered by Anthropic's OSS Scanner, as bug ANT-2026-L5GJ7M7X.

NEWS

@@ -39,6 +39,10 @@ GNU coreutils NEWS                                    -*- outline -*-
   lookup on a file without an ACL.
   [bug introduced in coreutils-9.6]
 
+  'mv -Z' no longer blocks when setting the SELinux security context of a
+  just-moved FIFO.
+  [bug introduced with SELinux support in coreutils-8.22]
+
   'realpath' without -s, or 'readlink' with -e,-f,-m no longer
   loop infinitely when resolving a symbolic link which
   resolves to a path beginning with the symbolic link itself.

src/selinux.c

@@ -202,7 +202,7 @@ restorecon_private (struct selabel_handle *selabel_handle, char const *path)
       return rc;
     }
 
-  fd = open (path, O_RDONLY | O_NOFOLLOW);
+  fd = open (path, O_RDONLY | O_NOFOLLOW | O_NOCTTY | O_NONBLOCK);
   if (fd == -1 && (errno != ELOOP))
     goto quit;
 

tests/misc/selinux.sh

@@ -62,4 +62,6 @@ for i in d f p; do
   c=$(stat --printf %C s2/$i); test x$c = x$ctx || fail=1
 done
 
+timeout 10 mv -Z s2/p s1 || fail=1
+
 Exit $fail