Dear Maintainer,

*** Reporter, please consider answering these questions, where appropriate ***

Download an image and run it:

 tt tmp/debian-14-genericcloud-amd64-daily-20260226-2400.qcow2

verify that it's possible to use sudo as the "debian" user without a
password.

Then install libsss-sudo:

 # apt update
 # apt install libsss-sudo

...and notice that sudo as the "debian" user says that the user is not
in the sudoers file.

The cause of this is an entry added by the postinst script to the end of
/etc/nsswitch.conf:

  sudoers: sss

Which seems to be caused by libsss-sudo assuming that the entry should
already exist as "sudoers: files" and trying to add "sss" to the end of
it.  This was proposed in base-files but not yet in the distribution
(also after dist-upgrade): https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=770825

The base-files version is "14" here, fwiw.

Hello,

We also got this bug reported in Ubuntu [1]. I have a proposed fix [2]
that boils down to:

1. Adding "files" to "libsss-sudo.nss";
2. Doing some postinst scripting to add "files" to /etc/nsswitch if "sss" is present.

(1) fixes new installations, and (2) fixes the upgrade from a broken
version. I have also attached the patch here.

Does this sound reasonable, or am I missing something?

Thanks,