avoid changing permissions on shadow files

slightly tested only.
Without this, my altimagebuild for Raspberry Pi had /etc/shadows with 644 perms