**Build scan:**
https://gradle-enterprise.elastic.co/s/o5fyjoyg4nmrk/tests/:qa:os:destructiveDistroTest.default-deb/org.elasticsearch.packaging.test.CertGenCliTests/test10Install

**Reproduction line:**
```
null
```

**Applicable branches:**
main

**Reproduces locally?:**
Didn't try

**Failure history:**
https://gradle-enterprise.elastic.co/scans/tests?tests.container=org.elasticsearch.packaging.test.CertGenCliTests&tests.test=test10Install

**Failure excerpt:**
```
java.lang.AssertionError: 
Expected: "file/directory: "<File> with owner "root" with group "root" with posix permissions [<OWNER_READ>,<OWNER_WRITE>,<GROUP_READ>,<OTHERS_READ>]
     but: path </usr/share/elasticsearch/NOTICE.txt>Has permissions [GROUP_WRITE, OWNER_READ, OWNER_WRITE, GROUP_READ, OTHERS_READ]

  at __randomizedtesting.SeedInfo.seed([49D09F0DDE208AB3:A58A93F582B035E9]:0)
  at org.hamcrest.MatcherAssert.assertThat(MatcherAssert.java:18)
  at org.hamcrest.MatcherAssert.assertThat(MatcherAssert.java:6)
  at org.elasticsearch.packaging.util.Packages.lambda$verifyOssInstallation$12(Packages.java:214)
  at java.util.Spliterators$ArraySpliterator.forEachRemaining(Spliterators.java:1006)
  at java.util.stream.ReferencePipeline$Head.forEach(ReferencePipeline.java:762)
  at org.elasticsearch.packaging.util.Packages.verifyOssInstallation(Packages.java:214)
  at org.elasticsearch.packaging.util.Packages.verifyPackageInstallation(Packages.java:176)
  at org.elasticsearch.packaging.test.PackagingTestCase.install(PackagingTestCase.java:245)
  at org.elasticsearch.packaging.test.CertGenCliTests.test10Install(CertGenCliTests.java:51)
  at jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104)
  at java.lang.reflect.Method.invoke(Method.java:578)
  at com.carrotsearch.randomizedtesting.RandomizedRunner.invoke(RandomizedRunner.java:1758)
  at com.carrotsearch.randomizedtesting.RandomizedRunner$8.evaluate(RandomizedRunner.java:946)
  at com.carrotsearch.randomizedtesting.RandomizedRunner$9.evaluate(RandomizedRunner.java:982)
  at com.carrotsearch.randomizedtesting.RandomizedRunner$10.evaluate(RandomizedRunner.java:996)
  at org.junit.rules.TestWatcher$1.evaluate(TestWatcher.java:55)
  at org.junit.rules.TestWatcher$1.evaluate(TestWatcher.java:55)
  at com.carrotsearch.randomizedtesting.rules.StatementAdapter.evaluate(StatementAdapter.java:36)
  at com.carrotsearch.randomizedtesting.ThreadLeakControl$StatementRunner.run(ThreadLeakControl.java:390)
  at com.carrotsearch.randomizedtesting.ThreadLeakControl.lambda$forkTimeoutingTask$0(ThreadLeakControl.java:850)
  at java.lang.Thread.run(Thread.java:1623)

```
qa/os/src/test/java/org/elasticsearch/packaging/test/CertGenCliTests.java
.filter(k -> k.equals("http.host") == false)
                    .filter(k -> k.equals("cluster.initial_master_nodes") == false)
            )
            .put("node.name", "mynode")
            .put("xpack.security.transport.ssl.key", keyPath)
            .put("xpack.security.transport.ssl.certificate", certPath)
            .put("xpack.security.transport.ssl.certificate_authorities", caCertPath)
            .put("xpack.security.http.ssl.key", keyPath)
            .put("xpack.security.http.ssl.certificate", certPath)
            .putList("xpack.security.http.ssl.certificate_authorities", caCertPath)
            .put("xpack.security.transport.ssl.enabled", true)
            .put("xpack.security.http.ssl.enabled", true)
            .build();
        Files.write(
            installation.config("elasticsearch.yml"),
            newSettings.keySet().stream().map(k -> k + ": " + newSettings.get(k)).collect(Collectors.toList()),
            TRUNCATE_EXISTING
        );
        assertWhileRunning(() -> {
            final String password = setElasticPassword();
            assertNotNull(password);
            ServerUtils.makeRequest(Request.Get("https://127.0.0.1:9200"), "elastic", password, installation.config("certs/ca/ca.crt"));
        });
    }
    private String setElasticPassword() {
        Shell.Result result = installation.executables().resetPasswordTool.run("--auto --batch --silent --username elastic", null);
        return result.stdout();
    }
}