diff --git a/client/equo.py b/client/equo.py
index 083053f32..82fb392d7 100644
--- a/client/equo.py
+++ b/client/equo.py
@@ -19,6 +19,7 @@ sys.path.insert(0, '/usr/lib/entropy/client')
 sys.path.insert(0, '../libraries')
 sys.path.insert(0, '../server')
 sys.path.insert(0, '../client')
+
 from entropy.exceptions import SystemDatabaseError, OnlineMirrorError, \
     RepositoryError, TransceiverError, PermissionDenied, FileNotFound, \
     SPMError, ConnectionError
diff --git a/libraries/entropy/client/interfaces/db.py b/libraries/entropy/client/interfaces/db.py
index 32af81891..8bc68dc7d 100644
--- a/libraries/entropy/client/interfaces/db.py
+++ b/libraries/entropy/client/interfaces/db.py
@@ -369,10 +369,10 @@ class AvailablePackagesRepositoryUpdater(object):
 
         # create dir if it doesn't exist
         if not os.path.isdir(repo_data['dbpath']):
-            os.makedirs(repo_data['dbpath'], 0o775)
+            os.makedirs(repo_data['dbpath'], 0o755)
 
         const_setup_perms(etpConst['etpdatabaseclientdir'],
-            etpConst['entropygid'])
+            etpConst['entropygid'], f_perms = 0o644)
 
     def __validate_compression_method(self):
 
@@ -824,8 +824,9 @@ class AvailablePackagesRepositoryUpdater(object):
         if not os.path.isdir(filepath_dir) and not \
             os.path.lexists(filepath_dir):
 
-            os.makedirs(filepath_dir, 0o775)
-            const_setup_perms(filepath_dir, etpConst['entropygid'])
+            os.makedirs(filepath_dir, 0o755)
+            const_setup_perms(filepath_dir, etpConst['entropygid'],
+                f_perms = 0o644)
 
         fetcher = self._entropy.urlFetcher(
             url,
diff --git a/libraries/entropy/client/interfaces/repository.py b/libraries/entropy/client/interfaces/repository.py
index 5133f9165..c48db2dfb 100644
--- a/libraries/entropy/client/interfaces/repository.py
+++ b/libraries/entropy/client/interfaces/repository.py
@@ -80,6 +80,11 @@ class Repository:
             elif status == EntropyRepositoryBase.REPOSITORY_UPDATED_OK:
                 self.updated = True
                 self.updated_repos.add(repo)
+            elif status == EntropyRepositoryBase.REPOSITORY_PERMISSION_DENIED_ERROR:
+                self.not_available += 1
+                self.sync_errors = True
+            else: # fallback
+                self.not_available += 1
 
         # keep them closed
         self._entropy.close_repositories()
diff --git a/libraries/entropy/const.py b/libraries/entropy/const.py
index eb7d2ed6a..bef705436 100644
--- a/libraries/entropy/const.py
+++ b/libraries/entropy/const.py
@@ -972,12 +972,13 @@ def const_create_working_dirs():
         etpConst['entropygid'] = gid
         if not os.path.isdir(etpConst['entropyworkdir']):
             try:
-                os.makedirs(etpConst['entropyworkdir'])
+                os.makedirs(etpConst['entropyworkdir'], 0o775)
             except OSError:
                 pass
         w_gid = os.stat(etpConst['entropyworkdir'])[stat.ST_GID]
         if w_gid != gid:
-            const_setup_perms(etpConst['entropyworkdir'], gid)
+            const_setup_perms(etpConst['entropyworkdir'], gid,
+                recursion = False)
 
         if not os.path.isdir(etpConst['entropyunpackdir']):
             try:
@@ -994,7 +995,8 @@ def const_create_working_dirs():
         # always setup /var/lib/entropy/client permissions
         if not const_islive():
             # aufs/unionfs will start to leak otherwise
-            const_setup_perms(etpConst['etpdatabaseclientdir'], gid)
+            const_setup_perms(etpConst['etpdatabaseclientdir'], gid,
+                f_perms = 0o644)
 
 def const_configure_lock_paths():
     """