raises permission denied instead of 404