add root to allowgroups