diff --git a/sys/lib/dist/empty b/sys/lib/dist/empty
new file mode 100644
index 000000000..e69de29bb
diff --git a/sys/lib/sysconfig/proto/cdproto b/sys/lib/sysconfig/proto/cdproto
index 0942dc75c..c655613e3 100644
--- a/sys/lib/sysconfig/proto/cdproto
+++ b/sys/lib/sysconfig/proto/cdproto
@@ -1,15 +1,15 @@
+mode=ug+rw
+mode=o-w
 uid=sys
 gid=sys
 adm	d775 adm adm
 	uid=adm
 	gid=adm
-	keys.who 665
 	timezone	d775
 		*
 cfg	d775
 	+
-cron	d777 sys sys
-	bootes	664 bootes bootes
+cron	d775
 fd	d775
 lib	d775
 	+
@@ -20,17 +20,17 @@ mail	d775 upas upas
 	gid=upas
 	box	d775
 		bootes	d775 bootes bootes
-			mbox	a662 bootes bootes
+			mbox	a662 bootes bootes /sys/lib/dist/empty
 		glenda	d775 glenda glenda
-			mbox	a662 glenda glenda
-	faxoutqueue	d777
-	faxqueue	d777
+			mbox	a662 glenda glenda /sys/lib/dist/empty
+	faxoutqueue	d775
+	faxqueue	d775
 	fs	d555
 	grey	d775
 	lib	d775
 		*
-	queue	d777
-	tmp	d777
+	queue	d775
+	tmp	d775
 
 386	d775
 	+
@@ -54,7 +54,6 @@ sparc64	d775
 	+
 mips	d775
 	+
-
 acme	d775
 	+
 mnt	d775
@@ -93,8 +92,30 @@ sys	d775
 	lib	d775
 		skip=\.(pyo|pyc)$
 		+
-	log	d777 sys sys
-		cron	a664 bootes bootes
+	log	d775
+		auth	a662 sys sys /sys/lib/dist/empty
+		cpu	a662 sys sys /sys/lib/dist/empty
+		cron	a662 sys sys /sys/lib/dist/empty
+		cs	a662 sys sys /sys/lib/dist/empty
+		dns	a662 sys sys /sys/lib/dist/empty
+
+		cifsd	a662 sys sys /sys/lib/dist/empty
+		ftp	a662 sys sys /sys/lib/dist/empty
+		httpd	a662 sys sys /sys/lib/dist/empty
+		imap4d	a662 sys sys /sys/lib/dist/empty
+		ipboot	a662 sys sys /sys/lib/dist/empty
+		listen	a662 sys sys /sys/lib/dist/empty
+
+		mail		a662 sys sys /sys/lib/dist/empty
+		smtp		a662 sys sys /sys/lib/dist/empty
+		smtp.fail	a662 sys sys /sys/lib/dist/empty
+		smtpd		a662 sys sys /sys/lib/dist/empty
+		smtpd.mx	a662 sys sys /sys/lib/dist/empty
+		runq		a662 sys sys /sys/lib/dist/empty
+
+		secstore	a662 sys sys /sys/lib/dist/empty
+		timesync	a662 sys sys /sys/lib/dist/empty
+		
 	man	d775
 		+
 	src	d775
@@ -106,34 +127,34 @@ usr	d775
 	bootes	d775 bootes bootes
 		uid=bootes
 		gid=bootes
-		bin d775
-			386 d775
+		bin	d775
+			386	d775
 				+
-			rc d775
+			rc	d775
 				+
-		lib d775
+		lib	d775
 			*
-		tmp d775
+		tmp	d775
 	glenda	d775 glenda glenda
 		uid=glenda
 		gid=glenda
-		bin d775
-			386 d775
+		bin	d775
+			386	d775
 				+
-			rc d775
+			rc	d775
 				+
-		lib d775
+		lib	d775
 			*
-		tmp d775
+		tmp	d775
 
 dist	d775
-	plan9front d775
+	plan9front	d775
 		uid=glenda
-		.hgignore 664
-		.hg d775
+		.hgignore	664
+		.hg		d775
 			+
 
+NOTICE	444
 LICENSE	444
 LICENSE.afpl	444
 LICENSE.gpl	444
-NOTICE	444
diff --git a/sys/src/libdisk/proto.c b/sys/src/libdisk/proto.c
index c209ace8d..192efc0d8 100644
--- a/sys/src/libdisk/proto.c
+++ b/sys/src/libdisk/proto.c
@@ -33,6 +33,8 @@ struct Name {
 typedef struct Opt Opt;
 struct Opt {
 	int level;
+	long mode;
+	long mask;
 	Reprog *skip;
 	char *uid;
 	char *gid;
@@ -275,12 +277,6 @@ copyfile(Mkaux *mkaux, File *f, Dir *d, int permonly)
 		d = nd;
 
 	d->name = f->elem;
-	if(d->type != 'M'){
-		d->uid = "sys";
-		d->gid = "sys";
-		xmode = (d->mode >> 6) & 7;
-		d->mode |= xmode | (xmode << 3);
-	}
 	o = mkaux->opt;
 	if(strcmp(f->uid, "-") != 0)
 		d->uid = f->uid;
@@ -297,7 +293,8 @@ copyfile(Mkaux *mkaux, File *f, Dir *d, int permonly)
 			warn(mkaux, "inconsistent mode for %s", f->new);
 		else
 			d->mode = f->mode;
-	}
+	} else if(o && o->mask)
+		d->mode = (d->mode & ~o->mask) | (o->mode & o->mask);
 
 	if(p = strrchr(f->new, '/'))
 		d->name = p+1;
@@ -323,6 +320,92 @@ mkpath(Mkaux *mkaux, char *prefix, char *elem)
 	return p;
 }
 
+static int
+parsemode(char *spec, long *pmask, long *pmode)
+{
+	char op, set, *s;
+	long mode;
+	long mask;
+
+	s = spec;
+	op = set = 0;
+	mode = 0;
+	mask = DMAPPEND | DMEXCL | DMTMP;
+
+	if(*s >= '0' && *s <= '7'){
+		mask = 0666;
+		mode = strtoul(s, 0, 8);
+		op = '=';
+		s = "!";
+	}
+
+	for(; *s && op == 0; s++){
+		switch(*s){
+		case 'a':
+			mask |= 0666;
+			break;
+		case 'u':
+			mask |= 0600;
+			break;
+		case 'g':
+			mask |= 060;
+			break;
+		case 'o':
+			mask |= 06;
+			break;
+		case '-':
+		case '+':
+		case '=':
+			op = *s;
+			break;
+		default:
+			return 0;
+		}
+	}
+	if(s == spec)
+		mask |= 0666;
+
+	for(; *s; s++){
+		switch(*s){
+		case 'r':
+			mode |= 0444;
+			break;
+		case 'w':
+			mode |= 0222;
+			break;
+		case 'x':
+			mode |= 0111;
+			break;
+		case 'a':
+			mode |= DMAPPEND;
+			break;
+		case 'l':
+			mode |= DMEXCL;
+			break;
+		case 't':
+			mode |= DMTMP;
+			break;
+		case '!':
+			set = 1;
+			break;
+		default:
+			return 0;
+		}
+	}
+
+	if(op == '+' || op == '-')
+		mask &= mode;
+	if(op == '-')
+		mode = ~mode;
+	if(set)
+		*pmask = 0;
+
+	*pmask |= mask;
+	*pmode = (*pmode & ~mask) | (mode & mask);
+
+	return 1;
+}
+
 static void
 setopt(Mkaux *mkaux, char *key, char *val)
 {
@@ -354,6 +437,11 @@ setopt(Mkaux *mkaux, char *key, char *val)
 	} else if(strcmp(key, "gid") == 0){
 		free(o->gid); 
 		o->gid = *val ? estrdup(mkaux, val) : nil;
+	} else if(strcmp(key, "mode") == 0){
+		if(!parsemode(val, &o->mask, &o->mode))
+			warn(mkaux, "bad mode specification %s", val);
+	} else {
+		warn(mkaux, "bad option %s=%s", key, val);
 	}
 }