attachment permissions not right