prevent tarbomb exploits, force correct file perms