Comment 5 for bug 1820288

The subfiles are installed via:
debian/tomcat8-admin.install:1:debian/context/manager.xml /etc/tomcat8/Catalina/localhost/
debian/tomcat8-admin.install:2:debian/context/host-manager.xml /etc/tomcat8/Catalina/localhost/

But already when installing tomcat8 the path exists:
$ ll /var/lib/tomcat8/conf/Catalina/
drwxr-xr-x 2 root tomcat8 2 Sep 9 19:47 localhost/

We are looking at 8.0.32-1ubuntu1.11 .. 8.5.39-1ubuntu1~18.04.3 to compare.
Downgrading Bionic to the release version of tomcat8=8.5.30-1ubuntu1 already has the new permissions.

The path isn't owned by a package
# dpkg -S /var/lib/tomcat8/conf/Catalina/
dpkg-query: no path found matching pattern /var/lib/tomcat8/conf/Catalina/
=> so it must be postinst or first service start which creates it.

Uuuh, that is even more interesting.
Stop, remove, restart fixes the permission to what it had in the past:
root@b:~# systemctl stop tomcat8
root@b:~# ll /var/lib/tomcat8/conf/Catalina/
total 3
drwxrwxr-x 3 root tomcat8 3 Feb 27 07:40 ./
drwxr-xr-x 4 root root 11 Feb 27 07:40 ../
drwxr-xr-x 2 root tomcat8 2 Sep 9 19:47 localhost/
root@b:~# rm -rf /var/lib/tomcat8/conf/Catalina/localhost
root@b:~# systemctl start tomcat8
root@b:~# ll /var/lib/tomcat8/conf/Catalina/
total 3
drwxrwxr-x 3 root tomcat8 3 Feb 27 07:41 ./
drwxr-xr-x 4 root root 11 Feb 27 07:40 ../
drwxr-x--- 2 tomcat8 tomcat8 2 Feb 27 07:41 localhost