[core] enforce rwx------ on config file