Yes, it looks like dpkg sets up the file to be tracked as part of snapd package. $ dpkg -l snapd Desired=Unknown/Install/Remove/Purge/Hold | Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend |/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad) ||/ Name Version Architecture Description +++-==============-==============-============-============================================ ii snapd 2.45.1+20.04.2 amd64 Daemon and tooling that enable snap packages $ dpkg -L snapd |grep sudoer /etc/sudoers.d /etc/sudoers.d/99-snapd.conf $ apt upgrade snapd -y ... $ dpkg -l snapd Desired=Unknown/Install/Remove/Purge/Hold | Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend |/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad) ||/ Name Version Architecture Description +++-==============-============-============-============================================ ii snapd 2.48.3+20.04 amd64 Daemon and tooling that enable snap packages $ dpkg -L snapd|grep sudoe /etc/sudoers.d/99-snapd.conf $ dpkg -S /etc/sudoers.d/99-snapd.conf snapd: /etc/sudoers.d/99-snapd.conf Now the fun part: $ apt download snapd $ dpkg -c snapd_2.48.3+20.04_amd64.deb | grep sudoers Maybe we need to check whether anything can be done about this in the maintainer's scripts.