/var/spool/krb5-sync/ is in krb5-sync-plugin 3.0-4.
This file is owned by root:root, with mode 0o755.