better permissionRoot handling