The work_dir (trusted directory) permission mask:
Must be placed immediately after the path with no intervening spaces.
Can define [u]ser, [g]roup, [o]ther, and [a]all masks using the leading character (u, g, o, and a) followed by +, –, =, r, w, and x.
For example:
(u=rw,go=r) equals 0644
(ugo+r,u+w) equals 0644
(ugo+r,u+wx) equals 0755
(ugo=rwx,go–wx) equals 0755
There are many ways to define masks, but they are always evaluated from left to right. For example, suppose the mask is initially defined as 0777 (ugo=rwx). If you later remove w(rite) and x(ecute) for g(roup) and o(ther), the octal equivalent becomes 0744 and the mask (ugo=rwx,go–wx).
If no mask is specified (when the mask portion is optional), the directory uses the default write mask of 0666.
Valid syntax values are:
u ... user (or owner). g ... group. o ... other (or world). a ... all (sets u, g, and o). For example: (a+rw) turns on read and write for u, g, and o. + ... turn on bits. – ... turn off bits. = ... replace bits. For example: (u=rw) replaces user. r ... read bit. w ... write bit. x ... execute bit.
