manager: prevent file access outside of config dir