up2date isn't preserving permissions on lilo.conf backups and test copies being moved around. lilo.conf can contain passwords for either booting images or for restricting commands passed to the kernel, so it's kind of important to preserve the permissions :)
fixed in CVS.
addressed in errata due out today.