...

...

1. the package updates and the permissions get set to 0750 (because these are the permissions inside the rpm) 2. the scripts checks, complains that its wrong and corrects it 3. repeat

Right, that's how it works, since ever.

And that won't change, really.

System administrators can *choose and change* the permission strictness level of their installation, which can either be more strict or more lenient compared to the file permissions in an RPM package

Speaking purely hypothetically... fixing this properly, could be done from inside rpm. It'd need to read the configured permission policy "database" up-front, and on the fly, and modify the packaged permissions in case they are overridden by the policy, before actually setting them. The way things are, there **is** a very short window in time where permissions (from view of what the system administrator desires), will be **wrong**, during the update. And the messages shown, as annoying as they are, point that out. best regards Patrick