vps: tighten down permissions on unentitled services