file permission helpers; used by cfs backend module