I am no expert. But I think there is an 'easier' way too manage this with an overlay filesystem.
Have an immutable base with all permissions set. When a session is started have it be done in an in-memory overlay. On logout drop the overlay.
This might be easier if you don't want to rely on cronjobs. But as I have no experience myself setting this up... 'easier' should be taken with a grain of salt. I just took inspiration from docker.
OS2🍔PC