fix potential rootfs owner/group mismatch (tgz root only, patch from #4562)