Comment # 15 on bug 1114383 from Matthias Gerstner

Included in the current Tumbleweed snapshot dated 20181126, a new permissions
subpackage becomes available named 'permissions-zypp-plugin'. This is
currently not installed by default via a Recommends:, because I want it to be
tested a bit first.

Can you please try it out? It should suffice to install this plugin. Once the
plugin is present, after any zypper commit operation (this means
a complete 'zypper up' or 'zypper dup' process) is finished, 'chkstat' should
be called to reapply any custom permissions.

There is still a time window during which permissions can be wrong(namely
between an individual file being overwritten by a package update and until the
complete zypper commit operation is finished and chkstat is called). There can
be other such situations, however, when updating packages, and has to be
expected to some degree.