meta-phosphor: systemd: always run systemd-sysusers

systemd-sysusers.service is gated on ConditionNeedsUpdate=/etc, which
only fires while /etc is older than /usr. A reproducible build pins the
mtime of /usr, and /etc/.updated is written on the first boot into the
persistent /etc, so from that boot onwards the condition can never be
satisfied and the unit is skipped for good. Every sysusers.d fragment
on the image is then inert, no matter which package shipped it.

Clear both trigger conditions. They are OR-ed, so leaving
ConditionCredential in place would keep the unit gated on a credential
that is never present. systemd-sysusers is idempotent; on a bletchley15
BMC it takes ~240 ms when it creates accounts and ~123 ms when it has
no work.

This on its own does not fix the case that found it. usbmuxd's udev
rule needs a usbmux account that no recipe creates, and the recipe
change that defines it belongs in meta-openembedded, where it is now
upstream as 5b4d5deac5bb ("usbmuxd: create the usbmux user the udev
rule requires"); it is being brought in here as change 93705. This
change only makes sure that once such a fragment exists, it is acted
on.

Tested: bletchley15. Before, systemd-sysusers.service was skipped on
every boot after the first, with systemctl reporting the condition
unmet. After, it runs on each boot at the times above and accounts
declared in sysusers.d are present once systemd-udevd parses its rules.
The end-to-end usbmuxd result was observed with the meta-openembedded
recipe change also applied, and is not claimed for this commit alone.

Change-Id: I38cbec7a7ebbefb48603cf81320032249655d40a
Signed-off-by: Eric Chiang Quanta <Eric.Chiang@quantatw.com>

meta-phosphor/recipes-core/systemd/systemd/10-run-always.conf

diff --git a/meta-phosphor/recipes-core/systemd/systemd/10-run-always.conf b/meta-phosphor/recipes-core/systemd/systemd/10-run-always.conf
new file mode 100644
index 0000000..79789ba
--- /dev/null
+++ b/meta-phosphor/recipes-core/systemd/systemd/10-run-always.conf
@@ -0,0 +1,3 @@
+[Unit]
+ConditionNeedsUpdate=
+ConditionCredential=

meta-phosphor/recipes-core/systemd/systemd_%.bbappend

diff --git a/meta-phosphor/recipes-core/systemd/systemd_%.bbappend b/meta-phosphor/recipes-core/systemd/systemd_%.bbappend
index 6736dcf..64f430b 100644
--- a/meta-phosphor/recipes-core/systemd/systemd_%.bbappend
+++ b/meta-phosphor/recipes-core/systemd/systemd_%.bbappend
@@ -27,16 +27,26 @@
 
 SRC_URI:append = " \
   file://40-hardware-watchdog.conf \
+  file://10-run-always.conf \
   "
 
 FILES:${PN}:append = " \
   ${systemd_unitdir}/system.conf.d/40-hardware-watchdog.conf \
+  ${systemd_system_unitdir}/systemd-sysusers.service.d/10-run-always.conf \
   "
 
 do_install:append() {
     install -d -m 0755 ${D}${systemd_unitdir}/system.conf.d/
     install -m 0644 ${UNPACKDIR}/40-hardware-watchdog.conf ${D}${systemd_unitdir}/system.conf.d/
 
+    # systemd-sysusers is gated on ConditionNeedsUpdate=/etc, which compares
+    # against the mtime of /usr. Reproducible builds pin that mtime, so once
+    # /etc/.updated exists in a persistent /etc the condition is never met
+    # again and sysusers.d fragments shipped by later updates never run.
+    # Clear the unit's trigger conditions; sysusers is idempotent.
+    install -d -m 0755 ${D}${systemd_system_unitdir}/systemd-sysusers.service.d/
+    install -m 0644 ${UNPACKDIR}/10-run-always.conf ${D}${systemd_system_unitdir}/systemd-sysusers.service.d/
+
     # A number of udev devices would unlikely be present on a BMC and have large
     # helper executables associated with them.  Delete both the helpers and the
     # rules.