fixup permissions, template function calls