The umask as 0027 will generates permissions like:
0640 - for files
0750 - for directories

This should solve the grafana.db being accesable by any user for new installations.