/var/lib/krb5kdc/ is in krb5-kdc 1.12+dfsg-2ubuntu4.
This file is owned by root:root, with mode 0o700.