Yeah, we had some back and forth about this in https://cfengine.com/dev/issues/2278 with @estenberg 

My advice is to put resolv, shadow, passwd, and whatever else you can think of, in `paths`.

Then we can deprecate the `sys` versions over time, but they have to stay for at least one version after deprecation.

Regardless of what happens with this PR and the deprecation plan, I think adding to `paths` is a good idea.  I hope you agree.