still tracking rogue chmods