/var/spool/rainbow/2/ is in libnss-rainbow2 0.8.7-2.
This file is owned by root:root, with mode 0o755.