OK I now do chown -R _apt:root /var/cache/apt/archives/ /var/lib/apt/lists/ chown root /var/cache/apt/archives/lost+found /var/lib/apt/lists/lost+found in one of my boot scripts, sort of like rc.local.