Comment # 7 on bug 1114383 from Fabian Vogt

(In reply to Matthias Gerstner from comment #6)
> SuSEconfig was removed in openSUSE 10.3, because it was only invoked by YaST
> but not by zypper or rpm directly. I don't know of any replacement. Maybe
> there is a possibility to run a hook script after certain zypper operations?
> Adding the zypper maintainer, maybe he has got some input on this.

It might work to add

%transfiletriggerin -- /
/usr/bin/chkstat --system

to permissions.spec to run chkstat at the end of every transaction.

> @fvogt: Since there seem to be at least some valid use cases to add a custom
> setuid bit to kcheckpass, you could still add calls to %set_permissions and
> %verify_permissions to your package, to allow users to override the
> permissions in a defined away.

Yes, if a generic approach doesn't work it's something that can be considered.