TCB_AUTH_GROUP (boolean) If yes, newly created tcb shadow files will be group owned by the auth group.