When varnishd is started as root (or otherwise will a full privilege
set), the user will rightly expect that whatever permissions and mode
bits are set for a socket, varnishd will fix them to the specification
from the -a argument.