set umask for locked down machines