permissions fixup