Cannot create/modify users in the FinalizeScripts area

[gridhead]

mkosi.conf

[Distribution]
Distribution=centos
Release=9
Architecture=x86-64
Mirror=https://mirrors.tuna.tsinghua.edu.cn/centos-stream
RepositoryKeyCheck=no

[Output]
Format=disk
# Uses systemd-repart
Output=centgrid
ManifestFormat=json,changelog
# CompressOutput=xz
ImageVersion=0.1.1
ImageId=centos-test

[Content]
Bootable=yes
Bootloader=systemd-boot
Packages=kernel
         systemd
         systemd-boot
         udev
         dnf
         iproute
         ncurses
         basesystem
         sudo
WithRecommends=no
WithDocs=no
CleanPackageMetadata=yes
Locale=en_US.UTF-8
Timezone=Asia/Kolkata
Hostname=centgrid
RootPassword=centgrid
RootShell=/usr/bin/bash
Autologin=yes
FinalizeScripts=/home/fedohide-main/projects/centgrid/config.sh

[Validation]
Checksum=yes

config.sh

#!/bin/sh

# Forward
useradd -c centosuser -G wheel -m centosuser
echo "centosuser:password" | chpasswd

# Reverse
# userdel -rf centosuser

Error

...
‣  Generating hardware database
‣  Recording packages in manifest…
‣  Running finalize script /home/fedohide-main/projects/centgrid/config.sh…
chpasswd: line 1: user 'centosuser' does not exist
chpasswd: error detected, changes ignored
‣ "/work/finalize" returned non-zero exit code 1.

I am not sure what I am doing wrong here. Any help is appreciated.

[DaanDeMeyer]

@gridhead Use the --password option for useradd. --password takes an encrypted password, which can be generated using openssl passwd -1 -stdin

[gridhead]

@DaanDeMeyer, ack.

Trying that and will let you know about the findings.

[gridhead]

Unfortunately, no dice with the said changes.

Error

‣  Running postinstall script /home/fedohide-origin/projects/centgrid/config.sh…
/work/postinst: line 4: 21783 Segmentation fault      (core dumped) useradd --comment centosuser --groups wheel --password "$6$GS46qLbRcZN9TToD$2S1Ty5MUi/Yl4/FLV4F2emIHwtc1qxkv3nJ5SK4fEYY30kdxFbtpZRxm.ye65iohThsGrEilxjWnAY5TGPau51" --create-home centosuser
‣ "/work/postinst final" returned non-zero exit code 139.

I went back to read the documentation a bit and I found this excerpt.

If a script uses the .chroot extension, mkosi will chroot into the image using mkosi-chroot (see below) before executing the script. For example, if mkosi.postinst.chroot exists, mkosi will chroot into the image and execute it as the post-installation script.

So, I renamed my config.sh file to mkosi.postinst.chroot and added the same in the [Content] section of the mkosi.conf file and that seemed to work though.

I wonder why it did not work with the previous naming but ended up working when the script was renamed. Did it change the environment for execution to chroot?

[DaanDeMeyer]

@gridhead What system are you running mkosi from? I can't seem to reproduce the segmentation fault myself.

I wonder why it did not work with the previous naming but ended up working when the script was renamed. Did it change the environment for execution to chroot?

It should work as well without chroot really, I'm curious why it doesn't in your case. On my Fedora 39 machine it works without chroot at least.

[gridhead]

Mine is a Fedora Rawhide VM. I purposefully chose that as that is where I could get v20 easily from.

[fedohide-origin@fedohide-origin ~]$ hostnamectl
     Static hostname: fedohide-origin.apexaltruism.net
           Icon name: computer-vm
             Chassis: vm 🖴
          Machine ID: 40ed51b642054f6c8264692c8ba63299
             Boot ID: b21bbceb582046e986787f5907d10659
      Virtualization: kvm
    Operating System: Fedora Linux 40 (Cloud Edition Prerelease)
         CPE OS Name: cpe:/o:fedoraproject:fedora:40
      OS Support End: Tue 2025-05-13
OS Support Remaining: 1y 3month 4w 1d
              Kernel: Linux 6.8.0-0.rc0.20240110gitab27740f7665.4.fc40.x86_64
        Architecture: x86-64
     Hardware Vendor: QEMU
      Hardware Model: Standard PC _Q35 + ICH9, 2009_
    Firmware Version: Arch Linux 1.16.3-1-1
       Firmware Date: Tue 2014-04-01
        Firmware Age: 9y 9month 1w 5d

SELinux is in the enforcing state.

Edit: A wild guess but I wonder if the useradd binary used here (in the script) is from the host installation making the OS image and if that is the case, what if the useradd binary is broken on the host?

[DaanDeMeyer]

@gridhead It could be broken but that would surprise me. I can't reproduce it with rawhide either. I suspect it's an SELinux denial that is causing the coredump in useradd.

[gridhead]

Let me repeat a build after turning it off and report back to you.

[gridhead]

Nope, even with the SELinux set to permissive - this error ends up happening.

SELinux status

[fedohide-origin@fedohide-origin archgrid]$ getenforce
Permissive

Error

‣  Running postinstall script /home/fedohide-origin/projects/centgrid/config.sh…
/work/postinst: line 4:  7881 Segmentation fault      (core dumped) useradd --comment centosuser --groups wheel --password $(openssl passwd -1 password) --create-home centosuser
‣ "/work/postinst final" returned non-zero exit code 139.

But if I were to rename the config.sh to mkosi.postinst.chroot - it ends up working.

mkosi.postinst.chroot

useradd --comment centosuser --groups wheel --password $(openssl passwd -1 password) --create-home centosuser

Log

...
‣  Running postinstall script /home/fedohide-origin/projects/archgrid/mkosi.postinst.chroot…
...

[DaanDeMeyer]

@gridhead Unfortunately without being able to reproduce the error I can't do much. You could try to look at the coredump to figure out more what is crashing and where and report a bug to the corresponding project.

[gridhead]

@DaanDeMeyer, will do.

Edit: For now, I am gonna mark the response stating the script contents to be in the mkosi.postinst.chroot file as the answer in the interest of those who might end up facing a similar problem.