#1146436 ionotify watcher for /etc/netgroup gets installed even if file does not exist

Package:
nscd
Source:
nscd
Description:
GNU C Library: Name Service Cache Daemon
Submitter:
Mike Gabriel
Date:
2026-09-01 20:19:02 UTC
Severity:
normal
#1146436#5
Date:
2026-09-01 20:15:57 UTC
From:
To:
Package: nscd
Version: 2.41-12+deb13u3

For nscd operations, in nss/nss_files/files-init.c in glibc [1]
various files in /etc/ get registered with inotify.

The registration passage in the code of the referenced files and the
list of files getting registered is this:

```
   register_file (cb, pwddb, "/etc/passwd", 0);
   register_file (cb, grpdb, "/etc/group", 0);
   register_file (cb, hstdb, "/etc/hosts", 0);
   register_file (cb, hstdb, "/etc/resolv.conf", 1);
   register_file (cb, servdb, "/etc/services", 0);
   register_file (cb, netgrdb, "/etc/netgroup", 0);
```

/etc/netgroup is not shipped by any package in Debian (afaict), so all
systems using nscd probably show log messages such as the following
(sorry, in German):

2026-09-01T21:15:31.641784+02:00 contentserver nscd: 1690546 Die
inotify-basierte Überwachung für die Datei »/etc/netgroup«
deaktiviert: Datei oder Verzeichnis nicht gefunden
2026-09-01T21:15:31.641941+02:00 contentserver nscd: 1690546 »stat«
für die Datei »/etc/netgroup« ist fehlgeschlagen; weiterer Versuch
folgt später: Datei oder Verzeichnis nicht gefunden

(basically a file not found error)

The /etc/netgroup file is only needed if nsswitch.conf has a
"netgroup: files [...]" in it, but even if the built-in files nss
backend is not used in /etc/nsswitch.conf, the inotify registration is
attempted (without checking if the file exists).

We stumbled over this issue in Debian Edu and our temp solution is to
touch an empty /etc/netgroup during provisioning process of Debian Edu
machines. But that's rather a work-around. See [2].

Mike

[1]
https://sources.debian.org/src/glibc/2.43-4/nss/nss_files/files-init.c?hl=49#L49
[2] #1146398