what permissions does koji-gc need?