hardening: umask restrictions: initial revamp