Even more sane permissions. This should be handled via a umask, like in many other places.