I get the same matter.
The way to resolve the problem is to use the other linux to fix the owner.
For example, you have a ubuntu as a virtual machine on your computer(MacOS or Windows it doesn't matter.) If you have the other raspberry, it is right for this working. You need to use a USB adapter for your micro sd card which is your "pi".
Then, plug the "pi" to your linux machine. Execute the cli df -h. You see the /media or /dev in front of you.
Go into it, cd /media or cd /dev. Perhaps, your pi not having the machine name, it may be as a series of number to represent your /boot and /. (Don't go to the wrong way, go to /. My operation is on virtual machine, ubuntu and the name is /media/virtuallmachine/mypie.)
The last name mypie is your "pi" machine name. If you haven't name it, the long number is to replace the name of it.
Run cd /media/virtuallmachine/mypie and then run ls. You can see the all of directories about /. (i.e. etc, usr, var, home, dev and media..etc..)
pi@retropie:/usr/lib/sudo $ ls -alh
total 472K
drwxr-xr-x 2 root root 4.0K Mar 14 2018 .
drwxr-xr-x 85 root root 4.0K Dec 8 10:29 ..
-rw-r--r-- 1 root root 915 Jun 5 2017 group_file.la
-rw-r--r-- 1 root root 9.4K Jun 5 2017 group_file.so
-rw-r--r-- 1 root root 936 Jun 5 2017 libsudo_util.la
lrwxrwxrwx 1 root root 21 Jun 5 2017 libsudo_util.so -> libsudo_util.so.0.0.0
lrwxrwxrwx 1 root root 21 Jun 5 2017 libsudo_util.so.0 -> libsudo_util.so.0.0.0
-rw-r--r-- 1 root root 78K Jun 5 2017 libsudo_util.so.0.0.0
-rwxr-xr-x 1 root root 14K Jun 5 2017 sesh
-rw-r--r-- 1 root root 897 Jun 5 2017 sudoers.la
-rw-r--r-- 1 root root 319K Jun 5 2017 sudoers.so
-rw-r--r-- 1 root root 920 Jun 5 2017 sudo_noexec.la
-rw-r--r-- 1 root root 5.3K Jun 5 2017 sudo_noexec.so
-rw-r--r-- 1 root root 927 Jun 5 2017 system_group.la
-rw-r--r-- 1 root root 5.4K Jun 5 2017 system_group.so
pi@retropie:/usr/lib/sudo $
If you know regex, you can quickly to change the permission. The command line is this-find . -name "*\.so*" -o -name "*\.la"". This is output under below.
pi@retropie:/usr/lib/sudo $ find . -name "*\.so*" -o -name "*\.la"
./group_file.la
./system_group.so
./sudo_noexec.la
./libsudo_util.so
./sudo_noexec.so
./sudoers.la
./libsudo_util.so.0.0.0
./libsudo_util.la
./libsudo_util.so.0
./sudoers.so
./system_group.la
./group_file.so
pi@retropie:/usr/lib/sudo $
The next step is to execute find . -name "*\.so*" -o -name "*\.la" -exec chmod 644 {} \;. This is a way to change all file having ".so"(including a ".so" with or without those tailing characters.) or ".la". Behind -exec, it is the command such as cp, mv, cat or others. The curly brace {} and \; must be with this command line(cli) for executing. Without them, it can not be executed. Why? Just Google it.
A site is for practicing regex. (Plus a book or site much better for learning.)
https://www.regexpal.com
==================================================================================
Above the article, it is enough for you to handle your matter.
Under below, I wonder why I get this matter.(It's able to be ignored.)
This path /usr/lib had been changed to its owner pi:pi. If your pi machine has this situation, it is needed to be change to root:root.
Under the path-/usr/lib/, there are many user library. My situation is all of them being changed to pi:pi. So, it should be changed back to root:root.
pi@retropie:/usr $ ls -alh
total 104K
drwxr-xr-x 10 root root 4.0K Mar 14 2018 .
drwxr-xr-x 21 root root 4.0K Dec 18 13:56 ..
drwxr-xr-x 2 root root 48K Dec 25 15:16 bin
drwxr-xr-x 2 root root 4.0K Dec 2 16:31 games
drwxr-xr-x 94 root root 12K Dec 8 10:33 include
drwxr-xr-x 85 pi pi 4.0K Dec 8 10:29 lib
drwxrwsr-x 10 root staff 4.0K Dec 6 15:42 local
drwxr-xr-x 2 root root 12K Dec 17 18:32 sbin
drwxr-xr-x 220 root root 4.0K Dec 13 10:14 share
drwxr-xr-x 7 root root 4.0K Dec 8 10:54 src
pi@retropie:/usr $
Why I get the matter? I am specious on a way I had run "find /home/pi -type f -group pi -exec chmod 700 {} \;" and "find /home/pi -type d -group pi -exec chmod 700 {} \;". This way is to make my /home/pi to be limit their rwx permission.
The other way is to change /etc/fstab to add a line #PARTUUID=14a75fe9-02 /home/pi/myweb ext4 defaults,acl 1 2 for acl.
About acl:
https://sites.google.com/site/itmyshare/system-admin-tips-and-tools/acl-on-linux----setfacl-examples
https://www.computerhope.com/unix/ugetfacl.htm
