Reading

 http://www.pathname.com/fhs/pub/fhs-2.3.html#VARRUNRUNTIMEVARIABLEDATA

it says that if I have a package Foobar2000, I can create a directory

 /var/run/Foobar2000

to use for run-time variable data and I can rely on this being cleaned up on
reboots. It works fine - if I drop file like

 /var/run/Foobar2000/some-random-file

and it's gone on the next reboot - however if I do

 /var/run/Foobar2000/some-directory/some-random-file

it sticks around. 

This is actually a potential security risk depending on how /var/run is used
(see below).

Am unsure about the wording of FHS (it's vague) but am pretty sure this is
wrong. The reason I want this is for PolicyKit - I'd like to store temporarily
granted privileges in a per-uid sub directory, e.g. like this (note the permissions)

# tree -ugp /var/run/PolicyKit
/var/run/PolicyKit
`-- [drwxrwx--- davidz   polkit  ]  uid500
    |-- [-r--rw---- davidz   polkit  ] 
pid-4820
    |-- [-r--rw---- davidz   polkit  ] 
pid-4820
    |-- [-r--rw---- davidz   polkit  ] 
pid-4827
    |-- [-r--rw---- davidz   polkit  ] 
session-Session1-polkit-gnome-examples-punch.grant
    `-- [-r--rw---- davidz   polkit  ] 
session-Session1-polkit-gnome-examples-twiddle.grant

e.g. where only uid 500 can see what privileges uid 500 have been granted.

<offtopic>
To explain the potential (minor) security problem the existence of the file 

/var/run/PolicyKit/uid500/pid-4827

means that the process with pid 4827, created 864.36 seconds after the kernel
booted, and owned by uid 500 is privileged for invoking actions on mechnanisms
(D-Bus system daemons or setuid helpers) that require the
'polkit-gnome-examples-frobnicate' privilege. If this is not cleaned up on
reboot.. there's a slight chance that uid 500 can create a process with pid 4827
and age 864.36 seconds on the next reboot...
</offtopic>

Anyway, I think this is an easy fix to be a bit more FHS compliant.