How to Override File Permissions and Ownership Permanently in Ubuntu Using dpkg-statoverride

System administrators running Ubuntu workstations and servers frequently need to customize file ownership or access permissions on system binaries, configuration files, and log directories. For example, you may want to restrict executable permissions on diagnostic binaries like tcpdump to members of a trusted pcap group, or alter permissions on a system daemon configuration file. However, if you simply use standard chown or chmod commands, the next routine package update via apt upgrade will overwrite your custom permissions with the package maintainer’s default settings. In Debian and Ubuntu systems, dpkg-statoverride provides the official mechanism to declare permanent ownership and mode overrides that survive package upgrades.

How dpkg-statoverride Operates in Ubuntu

The dpkg-statoverride utility manages an internal database file located at /var/lib/dpkg/statoverride. Whenever dpkg installs, upgrades, or unpacks a Debian package:

• Statoverride Database Lookup: dpkg consults /var/lib/dpkg/statoverride to determine whether any file being extracted has a registered administrative override.
• Automatic Mode Application: If an override exists for that file path, dpkg applies the declared user ownership, group ownership, and octal permission mode rather than the maintainer defaults packaged inside the .deb archive.
• Persistent Security Hardening: Security policies (such as removing SUID/SGID bits from legacy utilities or restricting group access to system logs) remain permanently enforced across unattended system upgrades and kernel maintenance.

Listing Active Statoverrides on the System

To inspect whether your Ubuntu system currently enforces any package statoverrides, execute the command with administrative privileges:

# Query all active statoverride entries on the system
sudo dpkg-statoverride --list

# Inspect raw database records in /var/lib/dpkg/statoverride
cat /var/lib/dpkg/statoverride

The output presents records formatted into four columns: user, group, octal permission mode, and target absolute file path.

root crontab 2755 /usr/bin/crontab
root ssl-cert 710 /etc/ssl/private

Registering a Permanent Permission Override

To declare a custom override, supply the desired user, group, numerical octal mode, and target file path using --add:

# Example: Restrict network packet capture to the 'pcap' group without world execution
sudo groupadd -f pcap
sudo dpkg-statoverride --add root pcap 0750 /usr/bin/tcpdump

# Verify that the override applied immediately to the physical file
ls -la /usr/bin/tcpdump

The dpkg-statoverride --add command immediately modifies the physical file’s ownership and mode on disk while registering the rule into the database for future package upgrades.

Removing SUID / SGID Bits Permanently from Binaries

Setuid (SUID) binaries execute with the permissions of the file owner (typically root), presenting potential privilege escalation vectors. If a system hardening policy requires stripping SUID flags from specific tools:

# Strip SUID bit from a utility (changing mode from 4755 to 0755)
sudo dpkg-statoverride --add root root 0755 /usr/bin/chfn

# Verify that the SUID bit ('s') is removed
ls -la /usr/bin/chfn

Even if an apt upgrade installs a newer build of the passwd package, dpkg automatically enforces mode 0755, preventing the SUID bit from being restored.

Modifying Existing Statoverride Rules

If you attempt to run --add on a file that already possesses a registered override, dpkg-statoverride returns an error to prevent accidental collisions. To update an existing rule, supply the --force or --update flag:

# Update an existing override rule with new permissions
sudo dpkg-statoverride --force --add root pcap 0754 /usr/bin/tcpdump

Removing Overrides and Restoring Package Defaults

To decommission a custom security policy and allow future package installations to manage the file’s permissions naturally:

# Remove the registered override from the database
sudo dpkg-statoverride --remove /usr/bin/tcpdump

# Verify removal from the database
sudo dpkg-statoverride --list /usr/bin/tcpdump

Note that removing an override from the database does not immediately reset the current on-disk file permissions. To immediately restore default maintainer permissions, reinstall the package via APT:

# Reinstall the package to re-apply maintainer default file modes
sudo apt install --reinstall -y tcpdump

Auditing and Troubleshooting Statoverride Errors

If an invalid file path or corrupt entry is introduced into /var/lib/dpkg/statoverride, APT operations may abort with syntax warnings. To validate database integrity:

# Check for non-existent file paths registered in the statoverride list
sudo dpkg-statoverride --list | while read user group mode path; do
    if [ ! -e "$path" ]; then
        echo "[WARNING] Registered path does not exist on disk: $path"
    fi
done