[fix] setgid / setuid as root forbidden