allow only root to own service