From c43291044e6a111ecfe159dc7da4085f44ddd160 Mon Sep 17 00:00:00 2001 From: Scott Stephens Date: Fri, 13 Feb 2026 22:21:57 -0500 Subject: [PATCH] nixos/tpm2: create tss user and group if either is required We only want to create users and groups in the module if they are the module defaults; if a user is specifying something else, we can presume that they are creating that themselves and don't want to conflict. The previous implementation caused problems when the module was configured to use the /dev/tpmrm0 kernel resource manager. In this configuration, /dev/tpmrm0 would be owned by root, but in the group tss, which caused there to be no tss user created. This in turn caused the tss group to be a "normal" group, not a system group, and udev does not assign devices to normal groups. Unfortunately, there is no isSystemGroup option corresponding to the isSystemUser option. To avoid messing with the user system, we add the tss user if we need the group. resolves #489756 --- nixos/modules/security/tpm2.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/nixos/modules/security/tpm2.nix b/nixos/modules/security/tpm2.nix index 44abf5a06410..cf1535e25ac3 100644 --- a/nixos/modules/security/tpm2.nix +++ b/nixos/modules/security/tpm2.nix @@ -276,11 +276,11 @@ in services.udev.extraRules = lib.mkIf cfg.applyUdevRules (udevRules cfg.tssUser cfg.tssGroup); # Create the tss user and group only if the default value is used - users.users.${cfg.tssUser} = lib.mkIf (cfg.tssUser == "tss") { + users.users.tss = lib.mkIf (cfg.tssUser == "tss" || cfg.tssGroup == "tss") { isSystemUser = true; group = "tss"; }; - users.groups.${cfg.tssGroup} = lib.mkIf (cfg.tssGroup == "tss") { }; + users.groups.tss = lib.mkIf (cfg.tssUser == "tss" || cfg.tssGroup == "tss") { }; environment.variables = lib.mkIf cfg.tctiEnvironment.enable ( lib.attrsets.genAttrs