[luatex] File permissions for luatex PDF output

[Ulrik Vieth]

I just made an interesting observation, which may have potential 
security implications.

Somehow PDF and AUX files from LuaLaTeX have file permissions 666, 
whereas LOG files have file permission 644 (according to umask 022).

In other words, PDF and AUX files generated by LuaLaTeX could become
world-writable to other users on a multi-user system.

What I find strange is that it happens when I run LuaLaTeX test files
using OpenType math fonts. It does not happen for ConTeXt test files.

It does not happen for plain LuaTeX with TFM fonts, e.g. "luatex story"
It does not happen for LuaLaTeX with TFM fonts, e.g. "lualatex sample2e"

It does however, happen, with plain LuaTeX when I load luaotfload,e.g.

luatex
\relax
\input luatofload.sty
\input story
\bye

Is there anything in luaotfload which instruments the file output
mechanism for PDF and AUX files, but fails to consider the umask?

Regards, Ulrik