first rewrite of file permission enforcement