Comment # 11 on bug 862975 from Franck Bui

(In reply to Andrei Borzenkov from comment #10)
> 
> Oh, that's interesting. Once upon a time encrypted filesystems were mounted
> by boot.crypto and so contained "noauto". On update it remains (more
> precisely, "noauto" is replace by "nofail" but it does not really matter).
> If /etc/fstab contains "noauto" or "nofail", dependency on local-fs.target
> is not generated. Which means that filesystem is mounted *after*
> systemd-tmpfiles-setup run (it needs to call mke2fs which takes time and
> local-fs.target does not wait for it).
> 
> Recently there was discussion on systemd-devel, and common opinion was that
> by "nofail" user declares that filesystem is optional, so it makes no sense
> to delay startup by waiting on it.
> 
> But note, that "tmp" option in /etc/crypttab does not necessary apply to
> /tmp; this case still is not covered by existing tmp.conf.

Then it might be simpler to simply create a service that fix the permissions
and this service being required by the mount service (the one dealing with you
temporary directory) ?