[galaxy-dev] Tightening up galaxy filesystem permissions