Services can fix their own permissions so if s6-rc is going to grow that functionality it should be in the generated run, not in some rarely used outboard helper service.
As answered on IRC, for ML completeness: no, because permissions should be fixed when the supervisor starts, not when the service starts. So a oneshot that runs right after the supervisors are started is the correct solution. -- Laurent
