Note that file must be owned by root / wheel