We would like to harden the installation of Oracle db 11.2.0.3 by applying umask 027 to the files in

Hi,

We would like to harden the installation of Oracle db 11.2.0.3 by applying umask 027 to the files in $ORACLE_HOME.
I found a parameter in oraparam.ini, UMASK=022 and changed that to UMASK=027.
Despite this change there are ~4000 files in different directories with looser security settings, mostly corresponding to umask 022

Is this expected behavior?
Is there a another, more official method for securing files in $ORACLE_HOME?
And, is it safe to apply a CHMOD operation to the other, "non-secured" files in $ORACLE_HOME?

BR;

Tomas