Run services out of "var" with friendly umask

Instead of having the "services" directory be a mix of both fixed and
writable files, put everything written at runtime into "var".