When you run
apt-cache policy <pkg>, it:
checks the repositories in
/etc/apt/sources.list.d/*.list to get all the enabled respository addresses
based on the above list, gets all the packages matching the pattern from each repository packages file -- these reside in
it also checks
/var/lib/dpkg/status to get the installation info for the package
It also does some other stuff but not important to go into the details of those.
Now, all it needs is the user has:
- read-execute permissions for the directories (starting from root leading to it, including all subdirectories)
- read permission on the relevant files
all the directories mentioned have read-execute by default for others with files having read for others.
As a result, on a default installation of Ubuntu, any user would be able to run
apt-cache policy <pkg> without needing any special privilege.
FWIW the binary
apt-cache itself has the permission
0755, so is executable by anyone.