During boot on Fedora 44 KDE Plasma Desktop Edition prerelease, systemd-tmpfiles fails to resolve the 'tss' user and group referenced in the tpm2-tss FAPI tmpfiles configuration. Journal shows the following errors during boot: systemd-tmpfiles: /usr/lib/tmpfiles.d/tpm2-tss-fapi.conf: Failed to resolve user 'tss' systemd-tmpfiles: Failed to resolve group 'tss' systemd-tmpfiles: Failed to parse ACL "default:group:tss:rwx" Additionally, the journal shows: systemd-sysusers.service - Create System Users skipped, no trigger condition checks were met. However the package provides the sysusers configuration file: /usr/lib/sysusers.d/tpm2-tss.conf After the system has booted, the user exists: getent passwd tss and manual execution of: sudo systemd-tmpfiles --create /usr/lib/tmpfiles.d/tpm2-tss-fapi.conf completes successfully. This suggests that systemd-sysusers is not being triggered early enough to create the 'tss' user before systemd-tmpfiles processes the tpm2-tss-fapi tmpfiles configuration. Reproducible: Always Steps to Reproduce: 1. Install Fedora 44 KDE Plasma Desktop Edition prerelease. 2. Ensure package tpm2-tss-fapi is installed. 3. Reboot the system. 4. Inspect the journal with: journalctl -b | grep -E "tss|tmpfiles|sysusers" Actual Results: systemd-tmpfiles: /usr/lib/tmpfiles.d/tpm2-tss-fapi.conf:2: Failed to resolve user 'tss': Unknown user systemd-tmpfiles: /usr/lib/tmpfiles.d/tpm2-tss-fapi.conf:6: Failed to resolve group 'tss': Unknown group systemd-tmpfiles: Failed to parse ACL "default:group:tss:rwx", ignoring: Invalid argument systemd-udevd: /usr/lib/udev/rules.d/60-tpm-udev.rules:3 Failed to resolve user 'tss', ignoring: Unknown user systemd-udevd: /usr/lib/udev/rules.d/60-tpm-udev.rules:4 Failed to resolve group 'tss', ignoring: Unknown group systemd-sysusers.service - Create System Users skipped, no trigger condition checks were met. Expected Results: The tss user and group should be fully initialized and resolvable by the system database (via systemd-sysusers or equivalent) before systemd-tmpfiles and systemd-udevd attempt to process the configuration files provided by the tpm2-tss package. Specifically, the boot sequence should ensure that systemd-sysusers.service completes successfully before services that depend on those users are triggered, preventing "Unknown user" errors and ensuring TPM device permissions are correctly applied on the first attempt. Additional Information: System information: Fedora Linux 44 (KDE Plasma Desktop Edition Prerelease) Architecture: x86_64 Relevant package version: tpm2-tss-fapi-4.1.3-9.fc44.x86_64 Relevant configuration files present on the system: /usr/lib/sysusers.d/tpm2-tss.conf /usr/lib/tmpfiles.d/tpm2-tss-fapi.conf /usr/lib/udev/rules.d/60-tpm-udev.rules After boot, the user exists: getent passwd tss tss:x:59:59:Account used for TPM access:/:/usr/sbin/nologin Device permissions appear correct after boot: ls -l /dev/tpmrm0 crw-rw---- 1 root tss ... Manual execution of the tmpfiles configuration succeeds: sudo systemd-tmpfiles --create /usr/lib/tmpfiles.d/tpm2-tss-fapi.conf
Additional observation: systemd-sysusers.service does not appear to run during boot. Output of: systemd-analyze blame | grep -E "sysusers|tmpfiles" shows only tmpfiles-related services: 148ms systemd-tmpfiles-setup.service 139ms systemd-tmpfiles-setup-dev-early.service 97ms systemd-tmpfiles-clean.service 49ms systemd-tmpfiles-setup-dev.service systemd-sysusers.service is not listed. This is consistent with the journal message: "systemd-sysusers.service - Create System Users skipped, no trigger condition checks were met." This suggests that systemd-sysusers may not be triggered at all during boot.
Based on https://github.com/systemd/systemd/issues/21665 it does not look like sysusers should be working like this and the user should be added using something like https://github.com/dracut-ng/dracut-ng/pull/2139/files Also observed https://discussion.fedoraproject.org/t/errors-regarding-user-group-tss-after-upgrade/183917
So after being a little more awake, it looks like this is fixed in dracut 110.
(In reply to Joe Walker from comment #3) > So after being a little more awake, it looks like this is fixed in dracut > 110. Adding #2444029 as dependency
*** This bug has been marked as a duplicate of bug 2442617 ***