elasticsearch can't read keystore file (.deb package install)

[withgit-contributor]

Related to; elastic/elasticsearch#26329

Elasticsearch version (bin/elasticsearch --version): Version: 6.0.0-beta2-SNAPSHOT, Build: d6a7e25/2017-08-28T13:34:58.542Z, JVM: 1.8.0_141

Plugins installed: [x-pack]

JVM version (java -version): openjdk version "1.8.0_141"

OS version (uname -a if on a Unix-like system):
Linux packer-virtualbox-iso-1501424719 4.4.0-87-generic #110~14.04.1-Ubuntu SMP Tue Jul 18 14:51:32 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux

Description of the problem including expected versus actual behavior:
After upgrading from 5.6.0-SNAPSHOT (with x-pack) to 6.0.0-beta2-SNAPSHOT (both from this morning's unified release builds) elasticsearch won't start because it can't read the /etc/elasticsearch/elasticsearch.keystore file

Steps to reproduce:

Please include a minimal but complete recreation of the problem, including
(e.g.) index creation, mappings, settings, query etc. The easier you make for
us to reproduce it, the more likely that somebody will take the time to look at it.

1. Install 5.6.0 elasticsearch and x-pack (links below)
2. I'm running in production mode (network.host: 0.0.0.0) and have changed the default password
3. service elasticsearch stop
4. /usr/share/elasticsearch/bin/elasticsearch-plugin remove x-pack
5. I backup my elasticsearch.yml before upgrading, taking the new config, then merge my changes back afterwards
6. dpkg -i --force-confnew ./elasticsearch-6.0.0-beta2-SNAPSHOT.deb
7. /usr/share/elasticsearch/bin/elasticsearch-plugin install -b file:///vagrant/qa/x-pack-6.0.0-beta2-SNAPSHOT.zip
8. service elasticsearch start see log below
9. -rw------- 1 root root 416 Aug 28 19:09 elasticsearch.keystore
   I "fixed" it with;
   chown root:elasticsearch /etc/elasticsearch/elasticsearch.keystore
chmod 660 /etc/elasticsearch/elasticsearch.keystore
   Now Elasticsearch starts

https://snapshots.elastic.co/downloads/elasticsearch/elasticsearch-5.6.0-SNAPSHOT.deb
https://snapshots.elastic.co/downloads/packs/x-pack/x-pack-5.6.0-SNAPSHOT.zip
https://snapshots.elastic.co/downloads/elasticsearch/elasticsearch-6.0.0-beta2-SNAPSHOT.deb
https://snapshots.elastic.co/downloads/packs/x-pack/x-pack-6.0.0-beta2-SNAPSHOT.zip

Provide logs (if relevant):

+ service elasticsearch start
 * Starting Elasticsearch Server
Exception in thread "main" org.elasticsearch.bootstrap.BootstrapException: java.nio.file.AccessDeniedException: /etc/elasticsearch/elasticsearch.keystore
Likely root cause: java.nio.file.AccessDeniedException: /etc/elasticsearch/elasticsearch.keystore
        at sun.nio.fs.UnixException.translateToIOException(UnixException.java:84)
        at sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:102)
        at sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:107)
        at sun.nio.fs.UnixFileSystemProvider.newByteChannel(UnixFileSystemProvider.java:214)
        at java.nio.file.Files.newByteChannel(Files.java:361)
        at java.nio.file.Files.newByteChannel(Files.java:407)
        at org.apache.lucene.store.SimpleFSDirectory.openInput(SimpleFSDirectory.java:77)
        at org.elasticsearch.common.settings.KeyStoreWrapper.load(KeyStoreWrapper.java:199)
        at org.elasticsearch.bootstrap.Bootstrap.loadSecureSettings(Bootstrap.java:225)
        at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:287)
        at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:130)
        at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:121)
        at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:69)
        at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:134)
        at org.elasticsearch.cli.Command.main(Command.java:90)
        at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:92)
        at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:85)
Refer to the log for complete error details.
   ...fail!