cleanup permissions