So if I understand you right: - the canonical place where all these dirs are created is base-files - the migration (of old systems) is however done by initscripts.
We've had previously many issues, where files/permissions/etc. from base-files changed, but were not updated (like now with nsswitch.conf). You're arguments were always that you don't wanna make such changes automatically, as they might not be what the user wants and the things like ufw or so, would be overkill for a basic package like base-files, right? What about adding a small script, that just checks for differences between the current and "fresh" state all these files/dirs/permissions/etc. and reports them to the user and also what he must do to bring it up to date? Cheers, Chris.
smime.p7s
Description: S/MIME cryptographic signature