early: set /tmp permissions explicitly