Bug 2448131

During boot on Fedora 44 KDE Plasma Desktop Edition prerelease, systemd-tmpfiles fails to resolve the 'tss' user and group referenced in the tpm2-tss FAPI tmpfiles configuration.

Journal shows the following errors during boot:

systemd-tmpfiles: /usr/lib/tmpfiles.d/tpm2-tss-fapi.conf: Failed to resolve user 'tss'
systemd-tmpfiles: Failed to resolve group 'tss'
systemd-tmpfiles: Failed to parse ACL "default:group:tss:rwx"

Additionally, the journal shows:

systemd-sysusers.service - Create System Users skipped, no trigger condition checks were met.

However the package provides the sysusers configuration file:

/usr/lib/sysusers.d/tpm2-tss.conf

After the system has booted, the user exists:

getent passwd tss

and manual execution of:

sudo systemd-tmpfiles --create /usr/lib/tmpfiles.d/tpm2-tss-fapi.conf

completes successfully.

This suggests that systemd-sysusers is not being triggered early enough to create the 'tss' user before systemd-tmpfiles processes the tpm2-tss-fapi tmpfiles configuration.

Reproducible: Always

Steps to Reproduce:
1. Install Fedora 44 KDE Plasma Desktop Edition prerelease.
2. Ensure package tpm2-tss-fapi is installed.
3. Reboot the system.
4. Inspect the journal with:

   journalctl -b | grep -E "tss|tmpfiles|sysusers"
Actual Results:
systemd-tmpfiles: /usr/lib/tmpfiles.d/tpm2-tss-fapi.conf:2: Failed to resolve user 'tss': Unknown user
systemd-tmpfiles: /usr/lib/tmpfiles.d/tpm2-tss-fapi.conf:6: Failed to resolve group 'tss': Unknown group
systemd-tmpfiles: Failed to parse ACL "default:group:tss:rwx", ignoring: Invalid argument
systemd-udevd: /usr/lib/udev/rules.d/60-tpm-udev.rules:3 Failed to resolve user 'tss', ignoring: Unknown user
systemd-udevd: /usr/lib/udev/rules.d/60-tpm-udev.rules:4 Failed to resolve group 'tss', ignoring: Unknown group
systemd-sysusers.service - Create System Users skipped, no trigger condition checks were met.

Expected Results:
The tss user and group should be fully initialized and resolvable by the system database (via systemd-sysusers or equivalent) before systemd-tmpfiles and systemd-udevd attempt to process the configuration files provided by the tpm2-tss package.

Specifically, the boot sequence should ensure that systemd-sysusers.service completes successfully before services that depend on those users are triggered, preventing "Unknown user" errors and ensuring TPM device permissions are correctly applied on the first attempt.

Additional Information:
System information:

Fedora Linux 44 (KDE Plasma Desktop Edition Prerelease)
Architecture: x86_64

Relevant package version:
tpm2-tss-fapi-4.1.3-9.fc44.x86_64

Relevant configuration files present on the system:

/usr/lib/sysusers.d/tpm2-tss.conf
/usr/lib/tmpfiles.d/tpm2-tss-fapi.conf
/usr/lib/udev/rules.d/60-tpm-udev.rules

After boot, the user exists:

getent passwd tss
tss:x:59:59:Account used for TPM access:/:/usr/sbin/nologin

Device permissions appear correct after boot:

ls -l /dev/tpmrm0
crw-rw---- 1 root tss ...

Manual execution of the tmpfiles configuration succeeds:

sudo systemd-tmpfiles --create /usr/lib/tmpfiles.d/tpm2-tss-fapi.conf