There's no need for 777 on these files, 744 is more than enough (you may also consider 740). But they should be owned by service0/group.
