BREAKING: don't inherit permissions by default (#13668)

Previously specifying permissions: {} was the same as specifying
permissions: "inherit". Now it will be the same as permissions: "none".
Not specifying any permissions (permissions: undefined) still means
permissions: "inherit".

2 files changed, 9 insertions, 9 deletions

diff --git a/cli/dts/lib.deno.ns.d.ts b/cli/dts/lib.deno.ns.d.ts
index e02368bfa..99ce225f1 100644
--- a/cli/dts/lib.deno.ns.d.ts
+++ b/cli/dts/lib.deno.ns.d.ts
@@ -122,7 +122,7 @@ declare namespace Deno {
      * If set to `true`, the global `net` permission will be requested.
      * If set to `false`, the global `net` permission will be revoked.
      *
-     * Defaults to "inherit".
+     * Defaults to `false`.
      */
     env?: "inherit" | boolean | string[];
 
@@ -131,7 +131,7 @@ declare namespace Deno {
      * If set to `true`, the global `hrtime` permission will be requested.
      * If set to `false`, the global `hrtime` permission will be revoked.
      *
-     * Defaults to "inherit".
+     * Defaults to `false`.
      */
     hrtime?: "inherit" | boolean;
 
@@ -142,7 +142,7 @@ declare namespace Deno {
      * if set to `string[]`, the `net` permission will be requested with the
      * specified host strings with the format `"<host>[:<port>]`.
      *
-     * Defaults to "inherit".
+     * Defaults to `false`.
      *
      * Examples:
      *
@@ -213,7 +213,7 @@ declare namespace Deno {
      * If set to `true`, the global `ffi` permission will be requested.
      * If set to `false`, the global `ffi` permission will be revoked.
      *
-     * Defaults to "inherit".
+     * Defaults to `false`.
      */
     ffi?: "inherit" | boolean | Array<string | URL>;
 
@@ -224,7 +224,7 @@ declare namespace Deno {
      * If set to `Array<string | URL>`, the `read` permission will be requested with the
      * specified file paths.
      *
-     * Defaults to "inherit".
+     * Defaults to `false`.
      */
     read?: "inherit" | boolean | Array<string | URL>;
 
@@ -233,7 +233,7 @@ declare namespace Deno {
      * If set to `true`, the global `run` permission will be requested.
      * If set to `false`, the global `run` permission will be revoked.
      *
-     * Defaults to "inherit".
+     * Defaults to `false`.
      */
     run?: "inherit" | boolean | Array<string | URL>;
 
@@ -244,7 +244,7 @@ declare namespace Deno {
      * If set to `Array<string | URL>`, the `write` permission will be requested with the
      * specified file paths.
      *
-     * Defaults to "inherit".
+     * Defaults to `false`.
      */
     write?: "inherit" | boolean | Array<string | URL>;
   }
diff --git a/runtime/permissions.rs b/runtime/permissions.rs
index c4a9d144f..707c9647e 100644
--- a/runtime/permissions.rs
+++ b/runtime/permissions.rs
@@ -1455,7 +1455,7 @@ impl<'de> Deserialize<'de> for ChildUnitPermissionArg {
       where
         E: de::Error,
       {
-        Ok(ChildUnitPermissionArg::Inherit)
+        Ok(ChildUnitPermissionArg::NotGranted)
       }
 
       fn visit_str<E>(self, v: &str) -> Result<ChildUnitPermissionArg, E>
@@ -1514,7 +1514,7 @@ impl<'de> Deserialize<'de> for ChildUnaryPermissionArg {
       where
         E: de::Error,
       {
-        Ok(ChildUnaryPermissionArg::Inherit)
+        Ok(ChildUnaryPermissionArg::NotGranted)
       }
 
       fn visit_str<E>(self, v: &str) -> Result<ChildUnaryPermissionArg, E>