Comment 2 for bug 557300

I've just added the following stat overrides on a system that had not yet upgraded to the latest tomcat6 package:

dpkg-statoverride --add cms cms 750 /var/log/tomcat6/
dpkg-statoverride --add cms cms 755 /var/lib/tomcat6/temp/
dpkg-statoverride --add cms cms 750 /var/cache/tomcat6
dpkg-statoverride --add root cms 775 /etc/tomcat6/Catalina
dpkg-statoverride --add root cms 775 /etc/tomcat6/Catalina/localhost
dpkg-statoverride --add root cms 775 /var/lib/tomcat6/webapps

I then ran a dist-upgrade. After the upgrade, the directories listed above had all had their user and or group changed as follows:

root@host:/var/lib/tomcat6# ls -ld /var/log/tomcat6/
drwxr-x--- 2 tomcat6 adm 4096 2010-04-08 09:47 /var/log/tomcat6/
root@host:/var/lib/tomcat6# ls -ld /var/lib/tomcat6/temp/
drwxr-xr-x 2 tomcat6 cms 4096 2009-12-21 15:11 /var/lib/tomcat6/temp/
root@host:/var/lib/tomcat6# ls -ld /var/cache/tomcat6
drwxr-x--- 2 tomcat6 adm 4096 2010-04-08 10:37 /var/cache/tomcat6
root@host:/var/lib/tomcat6# ls -ld /etc/tomcat6/Catalina
drwxrwxr-x 3 root tomcat6 4096 2009-10-12 09:27 /etc/tomcat6/Catalina
root@host:/var/lib/tomcat6# ls -ld /etc/tomcat6/Catalina/localhost
drwxrwxr-x 2 root tomcat6 4096 2010-04-08 10:37 /etc/tomcat6/Catalina/localhost
root@host:/var/lib/tomcat6# ls -ld /var/lib/tomcat6/webapps
drwxrwxr-x 4 root tomcat6 4096 2009-12-18 09:36 /var/lib/tomcat6/webapps

Before the upgrade, the permissions and ownership of the directories matched those specified in the statoverrides.

The postinst scripts for tomcat6_6.0.18-0ubuntu3.3_all.deb and tomcat6_6.0.24-2ubuntu1_all.deb both contain chowns and chmods like the following (from 6.0.18):

 chown -R tomcat6:adm /var/log/tomcat6 /var/cache/tomcat6
 chmod 750 /var/log/tomcat6 /var/cache/tomcat6
 chgrp tomcat6 /etc/tomcat6/tomcat-users.xml
 chmod 640 /etc/tomcat6/tomcat-users.xml
 chown tomcat6 /var/lib/tomcat6/temp
 chgrp tomcat6 /var/lib/tomcat6/webapps
 chmod 775 /var/lib/tomcat6/webapps
 chgrp tomcat6 /etc/tomcat6/Catalina /etc/tomcat6/Catalina/localhost
 chmod 775 /etc/tomcat6/Catalina /etc/tomcat6/Catalina/localhost

I don't know much about dpkg, but these certainly seem to be hardcoded to the tomcat6 and adm groups.