lib/granite: have to be root for writing /etc/nova/rootwrap.d