tarball: set safe umask when running as root
tarball: give a chance to turn off --xattrs