Fix the condition for entering the root configuration

Don't allow to enter the spoke if the root account is already configured
in the kickstart file. Make an exception for the Initial Setup in the
reconfiguration mode. It should be possible to re-enable a locked root.

Related: rhbz#1981807

pyanaconda/ui/gui/spokes/root_password.py

@@ -200,11 +200,26 @@ def completed(self):
 
     @property
     def sensitive(self):
-        # A password set in kickstart can only be changed in the GUI
-        # if the changesok password policy is set for the root password.
-        kickstarted_password_cant_be_changed = not self._users_module.CanChangeRootPassword \
-                                and not self.checker.policy.changesok
-        return not (self.completed and flags.automatedInstall and kickstarted_password_cant_be_changed)
+        # Allow changes in the interactive mode.
+        if not flags.automatedInstall:
+            return True
+
+        # Does the configuration allow changes?
+        if self._checker.policy.changesok:
+            return True
+
+        # Allow changes if the root account isn't
+        # already configured by the kickstart file.
+        if self._users_module.CanChangeRootPassword:
+            return True
+
+        # Allow to re-enable the locked root in the
+        # reconfiguration mode of the initial setup.
+        if is_reconfiguration_mode() \
+                and self._users_module.IsRootAccountLocked:
+            return True
+
+        return False
 
     def _checks_done(self, error_message):
         """Update the warning with the input validation error from the first

pyanaconda/ui/lib/services.py

@@ -15,8 +15,10 @@
 # License and may only be used or replicated with the express permission of
 # Red Hat, Inc.
 #
+from pyanaconda.flags import flags
+
 from pyanaconda.anaconda_loggers import get_module_logger
-from pyanaconda.core.constants import SETUP_ON_BOOT_RECONFIG
+from pyanaconda.core.constants import SETUP_ON_BOOT_RECONFIG, FIRSTBOOT_ENVIRON
 from pyanaconda.modules.common.constants.services import SERVICES
 from pyanaconda.modules.common.util import is_module_available
 
@@ -28,6 +30,9 @@ def is_reconfiguration_mode():
 
     :return: True or False
     """
+    if FIRSTBOOT_ENVIRON not in flags.environs:
+        return False
+
     if not is_module_available(SERVICES):
         return False
 

pyanaconda/ui/tui/spokes/root_password.py

@@ -63,7 +63,26 @@ def completed(self):
 
     @property
     def showable(self):
-        return not (self.completed and flags.automatedInstall and not self._policy.changesok)
+        # Allow changes in the interactive mode.
+        if not flags.automatedInstall:
+            return True
+
+        # Does the configuration allow changes?
+        if self._policy.changesok:
+            return True
+
+        # Allow changes if the root account isn't
+        # already configured by the kickstart file.
+        if self._users_module.CanChangeRootPassword:
+            return True
+
+        # Allow to re-enable the locked root in the
+        # reconfiguration mode of the initial setup.
+        if is_reconfiguration_mode() \
+                and self._users_module.IsRootAccountLocked:
+            return True
+
+        return False
 
     @property
     def mandatory(self):