To follow on from D5186, I think this change should actually improve the chances of temporary copies of the group and password file making it to the disk, without using O_SYNC. The idea is to avoid opening with O_SYNC, but to call fsync() after data is written.
For the group file, this is relatively easy, as the file is only written by gr_tmp() and gr_copy(), so I call fsync() at the end of writing data in both of these.
For the password file, we have a third possibility, which is someone calls pw_edit. In this case we can't just call fsync() on the descriptor for the temp file because (1) it isn't accessible in pw_edit and (2) the editor might have replaced the file with a different file. Instead we briefly open the file, fsync() it and close it. This is the same strategy adopted by the fsync command line utility.
This change should actually improve the chances of the data winding up on the disk in the case where the editor doesn't edit the file in place, because the O_SYNC wouldn't have applied to the new file.