more explicit permissions for config files