ensure that root part of FS path is root-owned