Our security scanner is detecting that backup directories created by fluentd are world writable.
I think they are getting created here:

          FileUtils.mkdir_p(backup_dir) unless Dir.exist?(backup_dir)
          File.open(backup_file, 'ab', system_config.file_permission || 0644) { |f|
            chunk.write_to(f)
          }

Is there any reason why those directories need to be world writable, rather than set to 755?

We are using fluentd version 1.7.0