I'm currently trying to sort things out with the [debian policy](http://www.debian.org/doc/manuals/securing-debian-howto/ch9.en.html#s-bpp-lower-privs).

The `postinst` and `postrm` looks very promising. However I have no experience with the magic `setuid` (this is the **s** in chmod) and `dpkg-statoverride`. 

```bash
      # 5. adjust file and directory permissions
       if ! dpkg-statoverride --list $SERVER_HOME >/dev/null
       then
           chown -R $SERVER_USER:adm $SERVER_HOME
           chmod u=rwx,g=rxs,o= $SERVER_HOME
       fi
```