Comment 7 for bug 1933826

I am still confused how 400 permission for grub.cfg can work at all.

Depending on the upstream grub version, it either cats things to it, or moves a new file to it. In both cases, either permissions reset to 600 or write is not allowed at all. Or one has custom/distro/downstream patched grub that does something different.

Are you inspecting grub.cfg which is stored on non-posix filesystems with restrictive mount umask set? I.e. grub.cfg stored on ESP mounted with fmask=0022,dmask=0022 ?