How can I find out what commands a package ran to install the software with apt-get install <package>?

For example, if I install a package that creates a user, how can I find out how it created that user?

  • The event flow of the package management and more info.
    – user44370
    Commented Jul 30, 2014 at 13:59
  • @illuminÉ Ah, the debian reference is still active? I recall submitting some patches for it once. Commented Jul 30, 2014 at 14:48
  • @FaheemMitha Yes I find even when it's old or even obsoleted their apt documentation is still very rich!
    – user44370
    Commented Jul 30, 2014 at 21:28

2 Answers 2


You look at the post-installation script, which is actually run by dpkg. You can find these in /var/lib/dpkg/info. Such scripts contain the name of the binary package in question, and have the suffix .postinst.

Note that there are also pre-installation scripts, which have the suffix .preinst, but I think that a package is much more likely to create a new user in a postinst script.

Did you have a particular example in mind?

An example is postgresql-common, which creates the postgres user. Here is an extract from the file /var/lib/dpkg/info/postgresql-common.postinst.

   # Make sure the administrative user exists
    if ! getent passwd postgres > /dev/null; then
        adduser --system --quiet --home /var/lib/postgresql --no-create-home \
            --shell /bin/bash --group --gecos "PostgreSQL administrator" postgres
  • WOW.. read my mind. I was actually trying to figure out how the postgresql package creted the user. Commented Jul 30, 2014 at 13:57

What apt-get install does is executing dpkg -i on the packages.

To find out what a package does while installing you have to unpack it. Look in /var/cache/apt/archives/ if your package is still there.

Inside the package is a data archive (data.tar.gz) and a control archive (control.tar.gz). Inside the control archive is a script to execute after the installation (postint) and one to execute after deleting the package (postrm). Open those scripts in an editor and see what the installation process does.

To unpack the package:

ar x package.deb

To unpack the control archive (after unpacking the package):

tar xfz control.tar.gz
  • I marked Faheem's answer as the solution because it is more specific to what I needed, but both answers complement each other. Commented Jul 30, 2014 at 13:58
  • 1
    Or since OP is on Debian (or a Debian-derivative, or at least using dpkg), dpkg-deb -c package.deb outdir is easier than the ar/tar combo. And will continue to work, even when dpkg changes formats (not sure if control.tar will change to xz)
    – derobert
    Commented Jul 30, 2014 at 15:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .