Hi Marek,

thanks for debugging and reporting this issue. This is *definitely* not expected 
behaviour and a major bug in grml-live. I think the sane approach is to not 
touch /var/spool at all, I've just commited a fix in grml-live's git which drops 
/var/spool from the "zero" action.

Marking this bugreport as fixed-in-git, the bugreport will be closed 
automatically with the soon to be expected upload of grml-live to the grml-
testing repository then.

Please let us know if you should encounter any problems, thanks!

regards,
-mika-