Thanks, this pointed me in the right direction. After playing out the possiblites in `cgdb` I finally came to the outcome I wanted:
```
631│     /* if directory does not have all user bits set (07xx) */
632├>    if ((sb.st_mode & 0700) != 0700)
633│     {
634│         chmod(vbuff, sb.st_mode | 0700);
635│     }
~/code/cfengine/core/libpromises/generic_agent.c

Breakpoint 2, GenericAgentInitialize (ctx=0x66cd10, config=0x66c440) at generic_agent.c:632
(gdb) p/o sb.st_mode
$3 = 040700
(gdb) p/d (040715 & 0700) != 0700
$4 = 0
(gdb) p/d (040711 & 0700) != 0700
$5 = 0
(gdb) p/d (040011 & 0700) != 0700
$6 = 1
(gdb) p/d (040211 & 0700) != 0700
$7 = 1
(gdb) p/d (040311 & 0700) != 0700
$8 = 1
(gdb) p/d (040411 & 0700) != 0700
$9 = 1
```
etc etc etc ... only test user bits / ignore and preserve group and other bits.