755 is rwxr-xr-x
644 is rw-r--r--

regarding sys, I don't know how they do it. I use the command allow
to put fossil temporarily in allow mode for the user doing the update.
(has to be done in the console, though).