While working on reproducible builds for openSUSE, I found
an interesting edge case where my local verification build
of the Factory avfs package differed from the official builds
because mine are done without preinstall images
while the official builds are done with them.

This is because the .spec file calls help2man
which calls avfsd that tries to call /usr/bin/fusermount --version

But in the preinstall image that has 4750 permissions,
so is not executable.

In the non-preinstallimage case, after installing the fuse package
there is one line
setting /usr/bin/fusermount to root:trusted 4755. (wrong permissions 4750)

from
/usr/share/permissions/permissions.easy:/usr/bin/fusermount root:trusted 4755
So it is now executable at build time and therefore adds an extra line
to the avfsd.1 man-page:
+fusermount version: 2.9.8

also to add to the confusion, after the non-preinstall build finished,
/usr/bin/fusermount had 4750 permissions again for some unknown reason.

Is there any way to make both behave the same?

Maybe having in /etc/sysconfig/security
PERMISSION_SECURITY="secure local"
before fuse gets installed...