do not chanage permission to use waf