forgot to prevent regular users from granting root