dispatch-conf: protect symlinks