Rewrite the tree-walk permissions checking

It looks like there were some cases where we'd miss a file we could read/write.