set_selinux_file_context() doesn't close selabel_hnd [1]. It means that
old file_contexts.* files are still mapped and used for selabel_lookup
even though there are new versions on the filesystem.

Simply adding selabel_close() to the end of set_selinux_file_context()
would probably have some performance impact so I'd add a new
function to selinux.c which would expose static void cleanup(void) to
other modules and call this function after a new selinux user mapping is added.

[1] https://github.com/shadow-maint/shadow/blob/master/lib/selinux.c#L76

e.g.


diff --git a/lib/prototypes.h b/lib/prototypes.h
index 688ad012ad00..d2b928f986bd 100644
--- a/lib/prototypes.h
+++ b/lib/prototypes.h
@@ -401,6 +401,7 @@ extern /*@observer@*/const char *crypt_make_salt (/*@null@*//*@observer@*/const
 /* selinux.c */
 #ifdef WITH_SELINUX
 extern int set_selinux_file_context (const char *dst_name, mode_t mode);
+extern void reset_selinux_handle ();
 extern int reset_selinux_file_context (void);
 extern int check_selinux_permit (const char *perm_name);
 #endif
diff --git a/lib/selinux.c b/lib/selinux.c
index c83545f99a4d..d78942dc2472 100644
--- a/lib/selinux.c
+++ b/lib/selinux.c
@@ -50,6 +50,10 @@ static void cleanup(void)
        }
 }
 
+void reset_selinux_handle () {
+       cleanup();
+}
+
 /*
  * set_selinux_file_context - Set the security context before any file or
  *                            directory creation.
diff --git a/src/useradd.c b/src/useradd.c
index 21da51b576f9..a4bf337cc42c 100644
--- a/src/useradd.c
+++ b/src/useradd.c
@@ -2587,6 +2587,7 @@ int main (int argc, char **argv)
 #endif                         /* WITH_AUDIT */
                        fail_exit (E_SE_UPDATE);
                }
+               reset_selinux_handle();
        }
 #endif                         /* WITH_SELINUX */

@aborah can you provide qa_ack? In order to verify this bugzilla you only need to execute the automated test already present in Regression/bz955769-useradd-not-assigning-correct-SELinux-user-to

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (new packages: shadow-utils), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:3997