split gui and library calls permissions
only run library calls with root privileges