For now we only want to ensure that the group permission mask is permissive enough to not clobber required permissions on the rootfs, so allow less strict masks as well. Signed-off-by: Jo-Philipp Wich <jo@mein.io>