allow-root and unsafe-perm