This is slightly more verbose and inconvenient, but it forces you to think about what the wrapper ownership and permissions will be.
This reverts commit 1db44c4ff1.
1db44c4ff1