avoid changing permissions on shadow files

slightly tested only.
Without this, my altimagebuild for Raspberry Pi had /etc/shadow with 644 perms