actually fix subgroup permission