set up recursive permissions first