generic: ensure non-root programs may access stuff in /root