Restrict permissions on service file