Less restrictive database file permissions, always set on boot

Refs #1224