security: fix a problem that allowed root to get into any directory