Thanks to snwint, we found out that it's the rpcbind package that normally creates this user group in its pre-install script: rpm -q rpcbind --scripts preinstall scriptlet (using /bin/sh): if [ -x /usr/bin/systemctl ]; then for service in rpcbind.service rpcbind.socket ; do if [ ! -e "/usr/lib/systemd/system/$service" ]; then mkdir -p /run/systemd/rpm/needs-preset touch "/run/systemd/rpm/needs-preset/$service" fi done fi /usr/sbin/sysusers2shadow rpc-user.conf <<"EOF" || [ -f /.buildenv ] u rpc - "User for rpcbind" /var/lib/empty EOF ... ... It's this part: /usr/sbin/sysusers2shadow rpc-user.conf <<"EOF" || [ -f /.buildenv ] u rpc - "User for rpcbind" /var/lib/empty EOF