It was previously being set to 0444 which triggered a warning in freeipa-healthcheck. Even root needs DAC_OVERRIDE capability to write to a 0o444 file which may not be available in some environments. https://pagure.io/freeipa/issue/8441 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>