Bug 2069305

Description of problem:
When creating a user with a public ssh key through kickstart, the final restorecon call has no effect, possibly because it's run against the mounted sysroot (Current RHEL 8.6 HEAD: https://github.com/rhinstaller/anaconda/blob/858d941ad2d299b4db44ee1ad99e2e2005c690e5/pyanaconda/core/users.py#L528)

This usually has no effect other than a warning in the syslog
> WARNING org.fedoraproject.Anaconda.Modules.Users:INFO:program:Warning no default label for /mnt/sysroot/home/achilleas/.ssh

However, in some cases, if the home or .ssh directory doesn't have the correct label on creation, the lack of a successful restorecon can cause issues.


How reproducible:
Always

Steps to Reproduce:

1. Create a kickstart file with a user configuration and an sshkey:
> user --name admin --password $6$GRmb7S0p8vsYmXzH$o0E020S.9JQGaHkszoog4ha4AQVs3sk8q0DvLjSMxoxHBKnB2FBXGQ/OkwZQfW/76ktHd0NX5nls2LPxPuUdl. --iscrypted --groups wheel --homedir /home/admin/
> sshkey --username admin ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL0AMjiKC8UTxZWLhCxtSZLfKPumUVdHUehCsOXiae/P admin@test
2. Serve or embed the kickstart file in the iso
3. Boot the iso and modify the kernel cmdline parameters with 'inst.ks=<kickstart file location>'
4. Start and complete the installation
5. Check the syslog for the warning message

Actual results:
> WARNING org.fedoraproject.Anaconda.Modules.Users:INFO:program:Warning no default label for /mnt/sysroot/home/achilleas/.ssh
appears in the log
If the home directory is not labelled properly on creation, the home and .ssh directories have the following selinux contexts:
> unconfined_u:object_r:default_t:s0

Expected results:
The warning should not appear in the log (the restorecon should be successful).
The home directory and .ssh directories should have the following selinux contexts:
For home directory:
> unconfined_u:object_r:user_home_dir_t:s0
and for .ssh
> system_u:object_r:ssh_home_t:s0


Additional info:

In all my tests I was using installer ISOs built using osbuild/imagebuilder that install using a tarball and include the liveimg directive in the kickstart file.  I don't know if this is relevant, but I didn't include it in the steps above.

In RHEL 8.6, there is a bug in useradd of the shadow-utils package that fails to label the home directory with the proper selinux contexts if the home directory has a trailing slash (as in the example above).
This isn't an Anaconda bug, but it's an example of how the restorecon failure can cause side-effects.  After installation, the system is inaccessible through SSH, because sshd can't read the authorized_keys file for the user with the mislabelled home directory.