set strict permissions