Bug 2023311

Description of problem:

I have various transfiletrigger in systemd, but the one that is relevant is this:

$ rpm -q --filetriggers systemd|grep -B2 'user-reload '
transfiletriggerpostun scriptlet (using /bin/sh) -- /etc/systemd/user, /usr/lib/systemd/user
# Execute daemon-reload in user managers.
/usr/lib/systemd/systemd-update-helper user-reload || :
--
transfiletriggerpostun scriptlet (using /bin/sh) -- /etc/systemd/user, /usr/lib/systemd/user
# We restart remaining user services that should be restarted here.
/usr/lib/systemd/systemd-update-helper user-restart || :

As you can see, they should trigger on /etc/systemd/user and /usr/lib/systemd/user.

When I install systemd-resolved, they trigger unexpectedly:

$ sudo dnf reinstall -y --rpmverbosity=debug https://kojipkgs.fedoraproject.org//packages/systemd/249.7/1.fc35/x86_64/systemd-resolved-249.7-1.fc35.x86_64.rpm
...
D: %transfiletriggerpostun(systemd-249.7-1.fc35.x86_64): scriptlet start
D: %transfiletriggerpostun(systemd-249.7-1.fc35.x86_64): execv(/bin/sh) pid 4516
D: Plugin: calling hook scriptlet_fork_post in selinux plugin
D: setexecfilecon: (/bin/sh, rpm_script_t) 
+ /usr/lib/systemd/systemd-update-helper user-reload
Failed to start transient service unit: Connection reset by peer
Failed to reload daemon: Transport endpoint is not connected
D: %transfiletriggerpostun(systemd-249.7-1.fc35.x86_64): waitpid(4516) rc 4516 status 0
...
D: %transfiletriggerpostun(systemd-249.7-1.fc35.x86_64): scriptlet start
D: %transfiletriggerpostun(systemd-249.7-1.fc35.x86_64): execv(/bin/sh) pid 4529
D: Plugin: calling hook scriptlet_fork_post in selinux plugin
D: setexecfilecon: (/bin/sh, rpm_script_t) 
+ /usr/lib/systemd/systemd-update-helper user-restart
Failed to start transient service unit: Connection reset by peer
Failed to start jobs: Transport endpoint is not connected
D: %transfiletriggerpostun(systemd-249.7-1.fc35.x86_64): waitpid(4529) rc 4529 status 0

The scriptlets fail because of some bug, I'm now investigating that. But the fact the the trigger fires at all seems to be a bug too. The package that is being installed has no files that would match those patterns:

$ rpm -ql systemd-resolved|grep user|wc -l
0

Version-Release number of selected component (if applicable):
systemd-249.7-1.fc35.x86_64
systemd-resolved-249.7-1.fc35.x86_64
rpm-4.17.0-1.fc35.x86_64
dnf-4.9.0-1.fc35.noarch

How reproducible:
Deterministic

Steps to Reproduce:
See above.

Actual results:
%transfiletriggerpostun fires, even though no files under the specified paths have been touched.

Expected results:
The trigger does not fire.