use umask to restrict file permissions