Select RHEL 10 Profiles are not install with their kickstarts

[Mab879]

Description of problem:

The following profile's kick starts fail to install with The installation was stopped due to an error which occurred while running in non-interactive cmdline mode. Since there cannot be any questions in cmdline mode, edit your kickstart file and retry installation.

• ism_o
• stig
• stig on uefi
• ism o on uefi
• stig gui

SCAP Security Guide Version:

6c4009b

Operating System Version:

RHEL 10

Steps to Reproduce:

1. Use autocontest to run
   a. /hardening/kickstart/ism_o
   b. /hardening/kickstart/stig
   c. /hardening/kickstart/uefi/ism_o
   d. /hardening/kickstart/uefi/stig
   e. /hardening/kickstart/with-gui/stig_gui

Actual Results:

Installs fail

Expected Results:

Installs pass

Additional Information/Debugging Steps:

Reproducibility locally using autocontest has been hard to do and the logs are not overly useful.

[comps]

Debugging this will probably need to involve running a local Contest copy against a HVM-capable remote system (via tmt or autocontest), by modifying lib/virt.py inside Contest, and making it sleep instead of destroying the install-in-progress VM.

https://github.com/RHSecurityCompliance/contest/blob/173989915e002607ea9219500192f0d0a930afcd/lib/virt.py#L444-L458

Basically add

util.log("install failed, sleeping")
import time
time.sleep(10000)

before the proc.terminate() call.

And then keep trying:

./contest-sshvm

and examine the logs in /tmp, specifically /tmp/anaconda.log, /tmp/storage.log, etc.

Yes, it would be great if Contest did all this automatically on an Anaconda install failure, but doing so is not trivial (some install failures might break sshd, or happen before sshd start), so I tend to use the above for now.

[comps]

So /tmp/packaging.log reveals:

INFO:dnf.rpm:/usr/sbin/restorecon: lstat(/usr/sbin/usbguard*) failed: No such file or directory
warning: %triggerin(selinux-policy-42.1.7-1.el10.noarch) scriptlet failed, exit status 255

ERROR:dnf.rpm:Error in <unknown> scriptlet in rpm package usbguard-selinux
ERROR:anaconda.modules.payloads.payload.dnf.transaction_progress:Error in <unknown> scriptlet in rpm package usbguard-selinux

and while Anaconda continues for a while, it ultimately exits with:

pyanaconda.modules.common.errors.installation.PayloadInstallationError: An error occurred during the transaction: Error in <unknown> scriptlet in rpm package usbguard-selinux

So this is indeed due to broken 10.1 composes, by https://issues.redhat.com/browse/RHEL-113206 .