base-files: add permission exceptions, do not clobber shadow permissions - based...