/var/spool/krb5-sync/ is in krb5-sync-plugin 3.1-1.
This file is owned by root:root, with mode 0o755.