We want to be able to put useful scripts in $vardir type places, but if the perms at the higher levels block this, then that can't work. The top-level should always be more permissive, and then it grows more restricted as we descend.
57b4a7efce