memcg: add permission check