use USE_ATTACHMENT_PERM in settings