Both ways. You can use /p, but there's a lot of typing involved and I find it rather unpleasant. Or you could run an export, edit the files, then run an import. Or when I do finally get around to coding the permissions GUI, you could use that too. (not gonna happen within the next few weeks)