Since we only need permission reduction in subprocess execution, use that facility provided by the os package