use restrictive umask for install and setup