Bug 973647

Description of problem:
For example /mnt/qa/scratch has not a default selinux context:

# matchpathcon /mnt/qa/scratch
/mnt/qa/scratch	<<none>>

Creating user with homedir in there fails:

# useradd -m -d /mnt/qa/scratch/user19376 user19376
# echo $?
12

The returned 12 means the homedir couldn't be created. It works fine in permissive, no AVCs related to this issue. (even with disabled dontaudit rules)

In useradd.c, there is the following code in create_home function:

> 1762 if (set_selinux_file_context (user_home, NULL) != 0) {
> 1763     fail_exit (E_HOMEDIR);
> 1764 }

And because no orig.context is passed in the second argument and at the same time matchpathcon returns no default context, the set_selinux_file_context function failes.
From lib/selinux.c (in shadow-utils srcrpm):

> 53 int set_selinux_file_context (const char *dst_name, const char *orig_name)
...
> 62         if (selinux_enabled) {
> 63                 /* Get the default security context for this file */
> 64                 if (matchpathcon (dst_name, 0, &scontext) < 0) {
> 65                         /* We could not get the default, copy the original */
> 66                         if (orig_name == NULL)
> 67                                 goto error;



Version-Release number of selected component (if applicable):
shadow-utils-4.1.5.1-5.el7.x86_64