GNU Coreutils fixes race condition in chcon when using partial contexts

A security fix has been implemented in GNU Coreutils to address a race condition within the chcon utility. This vulnerability occurred when users specified partial security contexts, potentially allowing for file manipulation between the time a context was read and when it was written.

The fix, identified as bug ANT-2026-9PFL6OLT and discovered by Anthropic's OSS Scanner, changes how the tool handles file operations. By utilizing file descriptors instead of path-based functions, the utility ensures more atomic operations when modifying SELinux contexts.

Technical implementation of the chcon fix

• File Descriptor Integration: The update includes the fcntl.h header to allow the utility to open a file descriptor when a partial context is provided.
• Race Condition Mitigation: Instead of using the separate getfileconat and setfileconat functions, the tool now opens a file descriptor with O_PATH to retrieve and subsequently set the file context.
• Library Dependency: The new logic relies on libselinux support for performing context operations directly on file descriptors.
• Test Suite Expansion: The commit adds new test cases in tests/chcon/traversal-missing.sh to verify behavior with complete contexts and to simulate open and openat errors.

Why it matters

This update improves the security posture of system administrators and automated deployment scripts that rely on chcon for SELinux management. By eliminating the window for race conditions, it hardens the reliability of security context enforcement on Linux systems.