diff --git a/services/begetctl/param_cmd.c b/services/begetctl/param_cmd.c
index 82f963a6f57d8a281e9c00dcf799f32e20af3699..9df5825a540e3636eff64176f17c1779833f9f2e 100755
--- a/services/begetctl/param_cmd.c
+++ b/services/begetctl/param_cmd.c
@@ -114,6 +114,7 @@ int SetParamShellPrompt(BShellHandle shell, const char *param)
         BShellEnvOutput(shell, "Error: parameter \'%s\' not found\r\n", realParameter);
         return -1;
     } else if (ret != 0 && ret != PARAM_CODE_NODE_EXIST) {
+        BShellEnvOutput(shell, "Error: Forbid to enter parameters \'%s\'\r\n", realParameter);
         return -1;
     }
     if (strcmp(realParameter, "#") == 0) {
diff --git a/services/param/manager/param_manager.c b/services/param/manager/param_manager.c
index 9ca6661ece4f392389af6720f390195afc1aee87..4940c6e964f9e0d4366a5284361546ce272769bc 100644
--- a/services/param/manager/param_manager.c
+++ b/services/param/manager/param_manager.c
@@ -155,7 +155,7 @@ int InitParamWorkSpace(int onlyRead)
         // add default dac policy
         ParamAuditData auditData = {};
         auditData.name = "#";
-        auditData.dacData.gid = 0; // for root
+        auditData.dacData.gid = 2000; // 2000 for shell
         auditData.dacData.uid = 0; // for root
         auditData.dacData.mode = DAC_DEFAULT_MODE; // 0774 default mode
         ret = AddSecurityLabel(&auditData);