hardening: setgid files: initial revamp