Bug 2178245 - root password specified in blueprint is not set when using "image-installer" compose type
Summary: root password specified in blueprint is not set when using "image-installer" ...
Keywords:
Status: NEW
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: osbuild
Version: 8.7
Hardware: All
OS: Linux
medium
medium
Target Milestone: rc
: ---
Assignee: Image Builder team
QA Contact: Release Test Team
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2023-03-14 16:05 UTC by Ameya Patil
Modified: 2023-06-26 14:15 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:
Type: Bug
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker RHELPLAN-151802 0 None None None 2023-03-14 16:06:27 UTC

Description Ameya Patil 2023-03-14 16:05:06 UTC
Description of problem:

Creating ISO image with type `image-installer` when we specify "root" user/password in the blueprint, the resulting ISO has the Kickstart file entry "osbuild.ks" creating with the `user` kickstart command for "root" user.

My blueprint,
~~~
# composer-cli blueprints show test-blueprint
name = "test-blueprint"
description = "Test blueprint"
version = "0.0.1"
packages = []
modules = []
groups = []
distro = ""

[customizations]

[[customizations.user]]
name = "root"
password = "$6$3vPBbx.xfSL/Cvth$T/M4AecT5pAAUtU3oZw7UCN5J8lTeUR8VHRh34XEY61nBVjrkRM5oKeNTw2d2DCT9/E9KbTdMk3Rzmk1lVJuU0"
home = "/root"
shell = "/usr/bin/bash"
~~~

The resulting ISO contains the Kickstart with "user" command.
~~~
$ cat ~/ISO/osbuild.ks 
liveimg --url file:///run/install/repo/liveimg.tar
user --name root --password $6$3vPBbx.xfSL/Cvth$T/M4AecT5pAAUtU3oZw7UCN5J8lTeUR8VHRh34XEY61nBVjrkRM5oKeNTw2d2DCT9/E9KbTdMk3Rzmk1lVJuU0 --iscrypted --shell /usr/bin/bash --homedir /root
~~~


This does not work because the "user" kickstart command can only be used to set password for normal user and not root user.
The command user for root user password is "rootpw" as per the Kickstart documentation.

  https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/system_design_guide/index#rootpw-required_kickstart-commands-for-system-configuration

On the installed system we are not able to login and upon booting the system to rescue mode, we can inspect the root filesystem and see that
Root password is indeed not set and root account is hence locked.
~~~
# cat /etc/shadow | grep root
root:!::0:99999:7:::
~~~


During installation with this ISO, we see that the following in the Anaconda GUI,
~~~
USER SETTINGS

Root Password
Root account is disabled

User Creation
User root will be created
~~~

It does allow for manually setting the root password from the GUI here though.


Version-Release number of selected component (if applicable):
~~~
# rpm -qa | grep osbuild
osbuild-composer-core-62-3.el8_7.x86_64
osbuild-composer-62-3.el8_7.x86_64
osbuild-composer-dnf-json-62-3.el8_7.x86_64
osbuild-lvm2-65-1.el8.noarch
osbuild-65-1.el8.noarch
osbuild-luks2-65-1.el8.noarch
osbuild-selinux-65-1.el8.noarch
osbuild-composer-worker-62-3.el8_7.x86_64
osbuild-ostree-65-1.el8.noarch
python3-osbuild-65-1.el8.noarch
~~~


How reproducible:
Everytime we build compose type to "image-installer" for creating ISO

Steps to Reproduce:
1. Create a Blueprint with [[customization.user]] entry for root user. Create an image-installer type compose for creating ISO and download the ISO
~~~
# composer-cli blueprints show test-blueprint
name = "test-blueprint"
description = "Test blueprint"
version = "0.0.1"
packages = []
modules = []
groups = []
distro = ""

[customizations]

[[customizations.user]]
name = "root"
password = "$6$3vPBbx.xfSL/Cvth$T/M4AecT5pAAUtU3oZw7UCN5J8lTeUR8VHRh34XEY61nBVjrkRM5oKeNTw2d2DCT9/E9KbTdMk3Rzmk1lVJuU0"
home = "/root"
shell = "/usr/bin/bash"
~~~

  # composer-cli compose start test-blueprint image-installer
  # composer-cli compose image <UUID>


2. Mount the ISO and verify the Kickstart file created and verify the kickstart file created has the root user being created with the "user" command and there is no "rootpw" command. 

  # mkdir ~/ISO

  # mount -v <UUID>-installer.iso ~/ISO
  # cat ~/ISO/osbuild.ks 


3. Use this ISO for installing a new machine and try login as root user and it should fail.



Actual results:
System is not allowing login through root user because password is not set for root user.

Expected results:
To set the root password correctly and allow login to root user.


Additional info:
This is only occuring for "image-installer" type compose.
I was able to create qcow2 image which has the correct root password set with this same blueprint when I boot this image
I also created an AMI image I was not able to boot AMI as I do not have an AWS account, but the raw image file created by osbuild-composer could be mounted and inspect the /etc/shadow and see that the root password is set.


Note You need to log in before you can comment on or make changes to this bug.