is owner always going to be a shell safe string? Should it be shellescape()ed as well?