Unable to login as root with a recent Rawhide Fedora Cloud image

[Ondrej Mosnacek]

Hi,

When I set up a rawhide cloud image
(Fedora-Cloud-Base-Rawhide-20211217.n.1.x86_64.qcow2 from
download.fedoraproject.org) with a root password using virt-sysprep:

    virt-sysprep -a <image> --root-password password:123456
--selinux-relabel [...]

...I am unable to login as root on the console once I boot it. When I
enter "root" in the login prompt, I immediately get "Login incorrect"
(it doesn't even ask for password). With the F35 Cloud image I can
login just fine with the same procedure.

Anyone know if this is an intentional change or a bug? If it's
intentional, what do I need to do to make root login work again? If
it's a bug, any idea which component to report it against?

Thanks,
-- 
Ondrej Mosnacek
Software Engineer, Linux Security - SELinux kernel
Red Hat, Inc.

[Stephen John Smoogen]

On Mon, 20 Dec 2021 at 10:31, Ondrej Mosnacek <omosnace(a)redhat.com&gt; wrote:
>  Hi,
>
>  When I set up a rawhide cloud image
>  (Fedora-Cloud-Base-Rawhide-20211217.n.1.x86_64.qcow2 from
>  download.fedoraproject.org) with a root password using virt-sysprep:
>
>      virt-sysprep -a <image> --root-password password:123456
>  --selinux-relabel [...]
>  
I believe this is intentional. Please see emails with subjects:

F36 Change: Make Rescue Mode Work With Locked Root (System-Wide Change proposal)
F36 Change: Users are administrators by default in the installer GUI.
(Self-Contained Change proposal)

there may be some others. Basically root login is no longer allowed
via PAM and possibly other tools. My understanding is that you need to
login as a user, and then become root.


>  ...I am unable to login as root on the console once I boot it. When
> I
>  enter "root" in the login prompt, I immediately get "Login
> incorrect"
>  (it doesn't even ask for password). With the F35 Cloud image I can
>  login just fine with the same procedure.
>
>  Anyone know if this is an intentional change or a bug? If it's
>  intentional, what do I need to do to make root login work again? If
>  it's a bug, any idea which component to report it against?
>
>  Thanks,
>  --
>  Ondrej Mosnacek
>  Software Engineer, Linux Security - SELinux kernel
>  Red Hat, Inc.
>  _______________________________________________
>  devel mailing list -- devel(a)lists.fedoraproject.org
>  To unsubscribe send an email to devel-leave(a)lists.fedoraproject.org
>  Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedoraproject.org/archives/list/[e-mail]
>  Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure


--
Stephen J Smoogen.
Let us be kind to one another, for most of us are fighting a hard
battle. -- Ian MacClaren

[Adam Williamson]

On Mon, 2021-12-20 at 10:43 -0500, Stephen John Smoogen wrote:
>  On Mon, 20 Dec 2021 at 10:31, Ondrej Mosnacek
> <omosnace(a)redhat.com&gt; wrote:
>  > 
>  > Hi,
>  > 
>  > When I set up a rawhide cloud image
>  > (Fedora-Cloud-Base-Rawhide-20211217.n.1.x86_64.qcow2 from
>  > download.fedoraproject.org) with a root password using virt-sysprep:
>  > 
>  >     virt-sysprep -a <image> --root-password password:123456
>  > --selinux-relabel [...]
>  > 
>  
>  I believe this is intentional. Please see emails with subjects:
>  
>  F36 Change: Make Rescue Mode Work With Locked Root (System-Wide Change proposal)
>  F36 Change: Users are administrators by default in the installer GUI.
>  (Self-Contained Change proposal)
>  
>  there may be some others. Basically root login is no longer allowed
>  via PAM and possibly other tools. My understanding is that you need to
>  login as a user, and then become root. 
No, I don't think that's it. None of those changes is meant to preclude
explicitly setting a root password.

I think this is actually a bug in Rawhide since 20211215.n.0 . I did
not investigate it in detail since I'm on PTO, my colleague Frantisek
Zatloukal (CC'ed) is looking into it. We see the same problem with any
login attempt on console after a minimal install; it works OK after a
Server install. The Workstation live images also fail to boot, they
just get stuck at the splash screen. We're not sure yet if it's two
different problems.

The most likely suspect seems to be:

Package:      authselect-1.3.0-3.fc36
Old package:  authselect-1.2.4-2.fc36

So CCing pbrezina. It's notable that the bug doesn't happen on upgraded
systems - there's a test that starts from a minimal install of F35 and
upgrades to F36, and that test works OK. So I suspect the problem
occurs when the installer tries to do initial authselect configuration
of the installed system. That's about as far as we got up to the
weekend. Frantisek has logs he could forward to pbrezina.
-- 
Adam Williamson
Fedora QA
IRC: adamw | Twitter: adamw_ha
https://www.happyassassin.net

[Adam Williamson]

On Mon, 2021-12-20 at 09:35 -0800, Adam Williamson wrote:
>  On Mon, 2021-12-20 at 10:43 -0500, Stephen John Smoogen wrote:
>  > On Mon, 20 Dec 2021 at 10:31, Ondrej Mosnacek <omosnace(a)redhat.com&gt; wrote:
>  > > 
>  > > Hi,
>  > > 
>  > > When I set up a rawhide cloud image
>  > > (Fedora-Cloud-Base-Rawhide-20211217.n.1.x86_64.qcow2 from
>  > > download.fedoraproject.org) with a root password using virt-sysprep:
>  > > 
>  > >     virt-sysprep -a <image> --root-password password:123456
>  > > --selinux-relabel [...]
>  > > 
>  > 
>  > I believe this is intentional. Please see emails with subjects:
>  > 
>  > F36 Change: Make Rescue Mode Work With Locked Root (System-Wide Change proposal)
>  > F36 Change: Users are administrators by default in the installer GUI.
>  > (Self-Contained Change proposal)
>  > 
>  > there may be some others. Basically root login is no longer allowed
>  > via PAM and possibly other tools. My understanding is that you need to
>  > login as a user, and then become root.
>  
>  No, I don't think that's it. None of those changes is meant to preclude
>  explicitly setting a root password.
>  
>  I think this is actually a bug in Rawhide since 20211215.n.0 . I did
>  not investigate it in detail since I'm on PTO, my colleague Frantisek
>  Zatloukal (CC'ed) is looking into it. We see the same problem with any
>  login attempt on console after a minimal install; it works OK after a
>  Server install. The Workstation live images also fail to boot, they
>  just get stuck at the splash screen. We're not sure yet if it's two
>  different problems.
>  
>  The most likely suspect seems to be:
>  
>  Package:      authselect-1.3.0-3.fc36
>  Old package:  authselect-1.2.4-2.fc36
>  
>  So CCing pbrezina. It's notable that the bug doesn't happen on upgraded
>  systems - there's a test that starts from a minimal install of F35 and
>  upgrades to F36, and that test works OK. So I suspect the problem
>  occurs when the installer tries to do initial authselect configuration
>  of the installed system. That's about as far as we got up to the
>  weekend. Frantisek has logs he could forward to pbrezina. 
I've filed a bug for this now:
https://bugzilla.redhat.com/show_bug.cgi?id=2034336
-- 
Adam Williamson
Fedora QA
IRC: adamw | Twitter: adamw_ha
https://www.happyassassin.net

[Ondrej Mosnacek]

On Mon, Dec 20, 2021 at 7:36 PM Adam Williamson
<adamwill(a)fedoraproject.org&gt; wrote:
>  On Mon, 2021-12-20 at 09:35 -0800, Adam Williamson wrote:
>  > On Mon, 2021-12-20 at 10:43 -0500, Stephen John Smoogen wrote:
>  > > On Mon, 20 Dec 2021 at 10:31, Ondrej Mosnacek <omosnace(a)redhat.com&gt;
> wrote:
>  > > >
>  > > > Hi,
>  > > >
>  > > > When I set up a rawhide cloud image
>  > > > (Fedora-Cloud-Base-Rawhide-20211217.n.1.x86_64.qcow2 from
>  > > > download.fedoraproject.org) with a root password using virt-sysprep:
>  > > >
>  > > >     virt-sysprep -a <image> --root-password password:123456
>  > > > --selinux-relabel [...]
>  > > >
>  > >
>  > > I believe this is intentional. Please see emails with subjects:
>  > >
>  > > F36 Change: Make Rescue Mode Work With Locked Root (System-Wide Change
> proposal)
>  > > F36 Change: Users are administrators by default in the installer GUI.
>  > > (Self-Contained Change proposal)
>  > >
>  > > there may be some others. Basically root login is no longer allowed
>  > > via PAM and possibly other tools. My understanding is that you need to
>  > > login as a user, and then become root.
>  >
>  > No, I don't think that's it. None of those changes is meant to preclude
>  > explicitly setting a root password.
>  >
>  > I think this is actually a bug in Rawhide since 20211215.n.0 . I did
>  > not investigate it in detail since I'm on PTO, my colleague Frantisek
>  > Zatloukal (CC'ed) is looking into it. We see the same problem with any
>  > login attempt on console after a minimal install; it works OK after a
>  > Server install. The Workstation live images also fail to boot, they
>  > just get stuck at the splash screen. We're not sure yet if it's two
>  > different problems.
>  >
>  > The most likely suspect seems to be:
>  >
>  > Package:      authselect-1.3.0-3.fc36
>  > Old package:  authselect-1.2.4-2.fc36
>  >
>  > So CCing pbrezina. It's notable that the bug doesn't happen on upgraded
>  > systems - there's a test that starts from a minimal install of F35 and
>  > upgrades to F36, and that test works OK. So I suspect the problem
>  > occurs when the installer tries to do initial authselect configuration
>  > of the installed system. That's about as far as we got up to the
>  > weekend. Frantisek has logs he could forward to pbrezina.
>
>  I've filed a bug for this now:
>  https://bugzilla.redhat.com/show_bug.cgi?id=2034336 
Thanks! Glad to see that this is actually a bug and is being worked
on. After Stephen's reply I was scratching my head over how to
"unlock" the root user and why none of the solutions I found online
were working :) Looks like I should be able to do what I wanted also
on an F35 image, so at least I'm not blocked by the bug.

-- 
Ondrej Mosnacek
Software Engineer, Linux Security - SELinux kernel
Red Hat, Inc.