How to check which package/process updated nsswitch?

Question

I've experincing problems with my /etc/nsswitch.conf. I'm not longer able to use sudo as my personal user (ldap).

I've checked dpkg.log, and it seems it's been som upgrades on the packages which matches the date of the /etc/nsswitch.conf modification.

How can I further verify which package has edited the /etc/nsswitch.conf? I didn't get any useful results when I ran grep -rHi nsswitch /var/log.

I suspect sudo-ldap, but I'm not sure.

EDIT: I've found this: https://answers.launchpad.net/ubuntu/+source/sudo/+question/706189. However, I'd like to know if it's possible to figure this out on the system itself!

Answer 1

There are essentially two ways that a package can modify a file; either

1. the package contains a file that overwrites the original directly

2. one of the package's control files preinst or postinst modifies the existing file

If you have already installed the package, then you can check for (1) by looking at its file list e.g.

dpkg -L sudo-ldap | grep nsswitch

If you haven't already installed the package, you can check its contents online at packages.ubuntu.com or using apt-file if you have installed that

apt-file list sudo-ldap | grep nsswitch

See also How do I find the package that provides a file?

---

For case (2), if you have already installed the package, you should find its control scripts in /var/lib/dpkg/info/ so for example

grep nsswitch /var/lib/dpkg/info/sudo-ldap.{pre,post}inst

or more generally

grep -l --include=\*.{pre,post}{inst,rm} '/etc/nsswitch.conf' /var/lib/dpkg/info/*

to list all the control files that mention the /etc/nsswitch.conf file. If you want to examine the control files of an uninstalled package, you could do something like

apt download sudo-ldap
ar x sudo-ldap_*.deb
tar xvf control.tar.zst ./postinst

You can then view the file with a pager, or grep within it. In the case of the sudo-ldap package you will likely find the following

$ grep -A3 nsswitch ./postinst 
# modify nsswitch.conf if needed
if [ -z "`grep \"^sudoers:\" /etc/nsswitch.conf`" ]
then
        echo "sudoers:  files ldap" >> /etc/nsswitch.conf
fi
make sure sudoers has the correct permissions and owner/group