apply: do not touch a file beyond a symbolic link