must run as root check