move group permissions to cookbook