diff --git a/modules/lib/fs.lua b/modules/lib/fs.lua
index 386228f..4c15934 100644
--- a/modules/lib/fs.lua
+++ b/modules/lib/fs.lua
@@ -17,14 +17,16 @@ do
   return tacl
  end
  local function canread(fn)
+  fn = fs.canonical(fn)
   if os.getuid() ~= "superuser" and fsattr[fn] then
    if not parseacl(fsattr[fn].read or "")[os.getuid()] then return false end
   end
   return true
  end
  local function canwrite(fn)
+  fn = fs.canonical(fn)
   if os.getuid() ~= "superuser" and fsattr[fn] then
-   if not parseacl(getattr(fn,"write"))[os.getuid()] then return false end
+   if not parseacl(fsattr[fn].write)[os.getuid()] then return false end
   end
   return true
  end
@@ -32,7 +34,7 @@ do
  fs.canread = canread
  fs.canwrite = canwrite
  local function getattr(fn,k)
-  fn = fs.simplify(fn)
+  fn = fs.canonical(fn)
   if not canread(fn) then return false end
   if fsattr[fn] then
    return fsattr[fn][k]
@@ -41,7 +43,7 @@ do
   end
  end
  local function setattr(fn,k,v)
-  fn = fs.simplify(fn)
+  fn = fs.canonical(fn)
   if not canwrite(fn) then return false end
   if k:find("\t") or v:find("\t") then return false end
   log(parseacl(getattr(fn,"write"))[os.getuid()])
@@ -86,6 +88,10 @@ do
   end
   return pt, pt[1], spt
  end
+ function fs.canonical(p)
+  local _,d,rp = fs.resolve(p)
+  return fs.simplify("/"..d.."/"..rp)
+ end
  function fs.exec(fc,m,...)
   return fT[fc][m](...)
  end