SPRoleDefinition.BasePermissions Property

When assigning permissions to the BasePermissions property, you can use the following operators:

• & - bitwise AND

• ^ - exclusive OR

• | - inclusive OR

For Microsoft SharePoint Foundation permissions, you often work with each permission individually, so it is common to use ^ or | as operators.

The following three lines illustrate operator usage:

1) oRoleDefinition.BasePermissions |= SPBasePermissions.ManageSubwebs;

Retains the current permissions mask but adds ManageSubwebs to the mask.

2) oRoleDefinition.BasePermissions ^= SPBasePermissions.CreateSSCSite;

Retains the current permissions mask but removes CreateSSCSite from the mask.

3) oRoleDefinition.BasePermissions &= SPBasePermissions.CreateAlerts;

Reduces the permissions mask so that it only contains CreateAlerts.

The following code example shows how to modify the base permissions of a role definition that originally has full permissions to a Web site by excluding ManagePermissions.

using (SPWeb oWebsite = SPContext.Current.Site.AllWebs["Subsite_Name"])
{
    SPRoleDefinitionCollection collRoles = oWebsite.RoleDefinitions;
    SPRoleDefinition oRoleDefinition = collRoles["Definition_Name"];
    oRoleDefinition.BasePermissions = SPBasePermissions.FullMask ^ 
        SPBasePermissions.ManagePermissions;

    oRoleDefinition.Update();
}

Note
Certain objects implement the IDisposable interface, and you must avoid retaining these objects in memory after they are no longer needed. For information about good coding practices, see Disposing Objects.

Reference