permission checking on directory reads