This is a simple security module that sub-divides several core permissions to allow for more fine-grained control. In other words, it restricts the powers granted by the core permissions such as 'administer system configuration' and 'administer users.'

It add the following permissions:

'administer themes', (Drupal 6)
'administer role permissions',
'administer roles',
'administer site information',
'administer modules', (Drupal 6)
'access admin by module', (Drupal 6)
'access settings pages', (Drupal 6)
'administer access rules', (Drupal 6)
'administer node settings' (Drupal 6)
theme' for each installed theme

Hopefully the intended use for most of these is obvious enough. (Permissions removed from the Drupal 7 version have been replaced by equivalent permissions in core.)

An example configuration would be to grant a role 'administer users' and 'administer permissions', but NOT the newly provided 'administer role permissions'. This would allow such users to create new users and assign them existing roles, but not modify the permissions assigned to roles.

Since a main purpose of this module is to remove access provided by core permissions, it would not be unusual to install this module and not assign any of it's permissions at all. Just enable the module, and your Drupal site is more secure.


If all you care about is access to the Roles and Permissions UIs, you might want to check out Secure Permissions module.

This module overlaps significantly with the Site Configuration Permissions. User are invited to evaluate it as an possible alternative to this project.

One key difference in philosophy between the two projects is noteworthy: With Site Configuration Permissions, the core 'administer site configuration' permission is treated as an override; that is, the permission provided by that module are ignored when the 'administer site configuration' permission is granted. This module, System Permissions, prefers the idea that specific permissions are dependent on more general permissions, not exceptions to them. This approach is what allows System Permissions to make Drupal sites more secure without any special configuration.

Module maintained by Ninjitsu Web Development.

Project information

  • caution Minimally maintained
    Maintainers monitor issues, but fast responses are not guaranteed.
  • caution Maintenance fixes only
    Considered feature-complete by its maintainers.
  • chart icon320 sites report using this module
  • shieldStable releases for this project are covered by the security advisory policy.
    Look for the shield icon below.