install configfiles with perm 640

The idea is that they live on the filesystem as root:kanla so that root
can read/write the files, kanla can read them, nobody else can do
anything with them.