ensures files have the right owner:group

unfortunately, not enough to get group-writable permissions (need acl or umask for that),
so we still need to run it after each install