ch          chan struct{} // guards lastChecked and modTime
	lastChecked time.Time     // last time nsswitch.conf was checked

	mu      sync.Mutex // protects nssConf
	nssConf *nssConf
}

func getSystemNSS() *nssConf {
	nssConfig.tryUpdate()
	nssConfig.mu.Lock()
	conf := nssConfig.nssConf
	nssConfig.mu.Unlock()
	return conf
}

// init initializes conf and is only called via conf.initOnce.