session: granted, root should never use these tools...
    ... but atleast now fs specs are consistent with the policy