Yes, permissions.local are probably the best way to go. No problem, I'm closing this as INVALID, since it is not an officially supported configuration.