tincctl: restrict umask argument for FORTIFY