config file should be owned by root