Add --allow-read (#1689)

Co-authored-by: Greg Altman <g.s.altman@gmail.com>

14 files changed, 271 insertions, 91 deletions

diff --git a/js/chmod_test.ts b/js/chmod_test.ts
index ceee5b065..e3676b547 100644
--- a/js/chmod_test.ts
+++ b/js/chmod_test.ts
@@ -4,7 +4,7 @@ import * as deno from "deno";
 
 const isNotWindows = deno.platform.os !== "win";
 
-testPerm({ write: true }, function chmodSyncSuccess() {
+testPerm({ read: true, write: true }, function chmodSyncSuccess() {
   const enc = new TextEncoder();
   const data = enc.encode("Hello");
   const tempDir = deno.makeTempDirSync();
@@ -23,7 +23,7 @@ testPerm({ write: true }, function chmodSyncSuccess() {
 
 // Check symlink when not on windows
 if (isNotWindows) {
-  testPerm({ write: true }, function chmodSyncSymlinkSuccess() {
+  testPerm({ read: true, write: true }, function chmodSyncSymlinkSuccess() {
     const enc = new TextEncoder();
     const data = enc.encode("Hello");
     const tempDir = deno.makeTempDirSync();
@@ -69,7 +69,7 @@ testPerm({ write: false }, function chmodSyncPerm() {
   assertEqual(err.name, "PermissionDenied");
 });
 
-testPerm({ write: true }, async function chmodSuccess() {
+testPerm({ read: true, write: true }, async function chmodSuccess() {
   const enc = new TextEncoder();
   const data = enc.encode("Hello");
   const tempDir = deno.makeTempDirSync();
@@ -88,7 +88,7 @@ testPerm({ write: true }, async function chmodSuccess() {
 
 // Check symlink when not on windows
 if (isNotWindows) {
-  testPerm({ write: true }, async function chmodSymlinkSuccess() {
+  testPerm({ read: true, write: true }, async function chmodSymlinkSuccess() {
     const enc = new TextEncoder();
     const data = enc.encode("Hello");
     const tempDir = deno.makeTempDirSync();
diff --git a/js/copy_file_test.ts b/js/copy_file_test.ts
index bdc455f45..3bd1f7229 100644
--- a/js/copy_file_test.ts
+++ b/js/copy_file_test.ts
@@ -20,7 +20,7 @@ function assertSameContent(filename1: string, filename2: string) {
   assertEqual(data1, data2);
 }
 
-testPerm({ write: true }, function copyFileSyncSuccess() {
+testPerm({ read: true, write: true }, function copyFileSyncSuccess() {
   const tempDir = deno.makeTempDirSync();
   const fromFilename = tempDir + "/from.txt";
   const toFilename = tempDir + "/to.txt";
@@ -32,7 +32,7 @@ testPerm({ write: true }, function copyFileSyncSuccess() {
   assertSameContent(fromFilename, toFilename);
 });
 
-testPerm({ write: true }, function copyFileSyncFailure() {
+testPerm({ write: true, read: true }, function copyFileSyncFailure() {
   const tempDir = deno.makeTempDirSync();
   const fromFilename = tempDir + "/from.txt";
   const toFilename = tempDir + "/to.txt";
@@ -48,7 +48,31 @@ testPerm({ write: true }, function copyFileSyncFailure() {
   assertEqual(err.name, "NotFound");
 });
 
-testPerm({ write: true }, function copyFileSyncOverwrite() {
+testPerm({ write: true, read: false }, function copyFileSyncPerm1() {
+  let caughtError = false;
+  try {
+    deno.copyFileSync("/from.txt", "/to.txt");
+  } catch (e) {
+    caughtError = true;
+    assertEqual(e.kind, deno.ErrorKind.PermissionDenied);
+    assertEqual(e.name, "PermissionDenied");
+  }
+  assert(caughtError);
+});
+
+testPerm({ write: false, read: true }, function copyFileSyncPerm2() {
+  let caughtError = false;
+  try {
+    deno.copyFileSync("/from.txt", "/to.txt");
+  } catch (e) {
+    caughtError = true;
+    assertEqual(e.kind, deno.ErrorKind.PermissionDenied);
+    assertEqual(e.name, "PermissionDenied");
+  }
+  assert(caughtError);
+});
+
+testPerm({ read: true, write: true }, function copyFileSyncOverwrite() {
   const tempDir = deno.makeTempDirSync();
   const fromFilename = tempDir + "/from.txt";
   const toFilename = tempDir + "/to.txt";
@@ -62,19 +86,7 @@ testPerm({ write: true }, function copyFileSyncOverwrite() {
   assertSameContent(fromFilename, toFilename);
 });
 
-testPerm({ write: false }, function copyFileSyncPerm() {
-  let err;
-  try {
-    deno.copyFileSync("/from.txt", "/to.txt");
-  } catch (e) {
-    err = e;
-  }
-  assert(!!err);
-  assertEqual(err.kind, deno.ErrorKind.PermissionDenied);
-  assertEqual(err.name, "PermissionDenied");
-});
-
-testPerm({ write: true }, async function copyFileSuccess() {
+testPerm({ read: true, write: true }, async function copyFileSuccess() {
   const tempDir = deno.makeTempDirSync();
   const fromFilename = tempDir + "/from.txt";
   const toFilename = tempDir + "/to.txt";
@@ -86,7 +98,7 @@ testPerm({ write: true }, async function copyFileSuccess() {
   assertSameContent(fromFilename, toFilename);
 });
 
-testPerm({ write: true }, async function copyFileFailure() {
+testPerm({ read: true, write: true }, async function copyFileFailure() {
   const tempDir = deno.makeTempDirSync();
   const fromFilename = tempDir + "/from.txt";
   const toFilename = tempDir + "/to.txt";
@@ -102,7 +114,7 @@ testPerm({ write: true }, async function copyFileFailure() {
   assertEqual(err.name, "NotFound");
 });
 
-testPerm({ write: true }, async function copyFileOverwrite() {
+testPerm({ read: true, write: true }, async function copyFileOverwrite() {
   const tempDir = deno.makeTempDirSync();
   const fromFilename = tempDir + "/from.txt";
   const toFilename = tempDir + "/to.txt";
@@ -116,14 +128,26 @@ testPerm({ write: true }, async function copyFileOverwrite() {
   assertSameContent(fromFilename, toFilename);
 });
 
-testPerm({ write: false }, async function copyFilePerm() {
-  let err;
+testPerm({ read: false, write: true }, async function copyFilePerm1() {
+  let caughtError = false;
   try {
     await deno.copyFile("/from.txt", "/to.txt");
   } catch (e) {
-    err = e;
+    caughtError = true;
+    assertEqual(e.kind, deno.ErrorKind.PermissionDenied);
+    assertEqual(e.name, "PermissionDenied");
   }
-  assert(!!err);
-  assertEqual(err.kind, deno.ErrorKind.PermissionDenied);
-  assertEqual(err.name, "PermissionDenied");
+  assert(caughtError);
+});
+
+testPerm({ read: true, write: false }, async function copyFilePerm2() {
+  let caughtError = false;
+  try {
+    await deno.copyFile("/from.txt", "/to.txt");
+  } catch (e) {
+    caughtError = true;
+    assertEqual(e.kind, deno.ErrorKind.PermissionDenied);
+    assertEqual(e.name, "PermissionDenied");
+  }
+  assert(caughtError);
 });
diff --git a/js/files_test.ts b/js/files_test.ts
index 9014e7b83..a4d8a064a 100644
--- a/js/files_test.ts
+++ b/js/files_test.ts
@@ -8,7 +8,7 @@ test(function filesStdioFileDescriptors() {
   assertEqual(deno.stderr.rid, 2);
 });
 
-test(async function filesCopyToStdout() {
+testPerm({ read: true }, async function filesCopyToStdout() {
   const filename = "package.json";
   const file = await deno.open(filename);
   assert(file.rid > 2);
@@ -18,7 +18,7 @@ test(async function filesCopyToStdout() {
   console.log("bytes written", bytesWritten);
 });
 
-test(async function filesToAsyncIterator() {
+testPerm({ read: true }, async function filesToAsyncIterator() {
   const filename = "tests/hello.txt";
   const file = await deno.open(filename);
 
@@ -32,7 +32,7 @@ test(async function filesToAsyncIterator() {
 
 testPerm({ write: false }, async function writePermFailure() {
   const filename = "tests/hello.txt";
-  const writeModes: deno.OpenMode[] = ["r+", "w", "w+", "a", "a+", "x", "x+"];
+  const writeModes: deno.OpenMode[] = ["w", "a", "x"];
   for (const mode of writeModes) {
     let err;
     try {
@@ -46,7 +46,35 @@ testPerm({ write: false }, async function writePermFailure() {
   }
 });
 
-testPerm({ write: true }, async function createFile() {
+testPerm({ read: false }, async function readPermFailure() {
+  let caughtError = false;
+  try {
+    await deno.open("package.json", "r");
+  } catch (e) {
+    caughtError = true;
+    assertEqual(e.kind, deno.ErrorKind.PermissionDenied);
+    assertEqual(e.name, "PermissionDenied");
+  }
+  assert(caughtError);
+});
+
+testPerm({ write: false, read: false }, async function readWritePermFailure() {
+  const filename = "tests/hello.txt";
+  const writeModes: deno.OpenMode[] = ["r+", "w+", "a+", "x+"];
+  for (const mode of writeModes) {
+    let err;
+    try {
+      await deno.open(filename, mode);
+    } catch (e) {
+      err = e;
+    }
+    assert(!!err);
+    assertEqual(err.kind, deno.ErrorKind.PermissionDenied);
+    assertEqual(err.name, "PermissionDenied");
+  }
+});
+
+testPerm({ read: true, write: true }, async function createFile() {
   const tempDir = await deno.makeTempDir();
   const filename = tempDir + "/test.txt";
   const f = await deno.open(filename, "w");
@@ -64,7 +92,7 @@ testPerm({ write: true }, async function createFile() {
   await deno.remove(tempDir, { recursive: true });
 });
 
-testPerm({ write: true }, async function openModeWrite() {
+testPerm({ read: true, write: true }, async function openModeWrite() {
   const tempDir = deno.makeTempDirSync();
   const encoder = new TextEncoder();
   const filename = tempDir + "hello.txt";
@@ -98,7 +126,7 @@ testPerm({ write: true }, async function openModeWrite() {
   await deno.remove(tempDir, { recursive: true });
 });
 
-testPerm({ write: true }, async function openModeWriteRead() {
+testPerm({ read: true, write: true }, async function openModeWriteRead() {
   const tempDir = deno.makeTempDirSync();
   const encoder = new TextEncoder();
   const filename = tempDir + "hello.txt";
diff --git a/js/mkdir_test.ts b/js/mkdir_test.ts
index 8b36c18f9..e88181485 100644
--- a/js/mkdir_test.ts
+++ b/js/mkdir_test.ts
@@ -2,14 +2,14 @@
 import { testPerm, assert, assertEqual } from "./test_util.ts";
 import * as deno from "deno";
 
-testPerm({ write: true }, function mkdirSyncSuccess() {
+testPerm({ read: true, write: true }, function mkdirSyncSuccess() {
   const path = deno.makeTempDirSync() + "/dir";
   deno.mkdirSync(path);
   const pathInfo = deno.statSync(path);
   assert(pathInfo.isDirectory());
 });
 
-testPerm({ write: true }, function mkdirSyncMode() {
+testPerm({ read: true, write: true }, function mkdirSyncMode() {
   const path = deno.makeTempDirSync() + "/dir";
   deno.mkdirSync(path, false, 0o755); // no perm for x
   const pathInfo = deno.statSync(path);
@@ -30,7 +30,7 @@ testPerm({ write: false }, function mkdirSyncPerm() {
   assertEqual(err.name, "PermissionDenied");
 });
 
-testPerm({ write: true }, async function mkdirSuccess() {
+testPerm({ read: true, write: true }, async function mkdirSuccess() {
   const path = deno.makeTempDirSync() + "/dir";
   await deno.mkdir(path);
   const pathInfo = deno.statSync(path);
@@ -48,14 +48,14 @@ testPerm({ write: true }, function mkdirErrIfExists() {
   assertEqual(err.name, "AlreadyExists");
 });
 
-testPerm({ write: true }, function mkdirSyncRecursive() {
+testPerm({ read: true, write: true }, function mkdirSyncRecursive() {
   const path = deno.makeTempDirSync() + "/nested/directory";
   deno.mkdirSync(path, true);
   const pathInfo = deno.statSync(path);
   assert(pathInfo.isDirectory());
 });
 
-testPerm({ write: true }, async function mkdirRecursive() {
+testPerm({ read: true, write: true }, async function mkdirRecursive() {
   const path = deno.makeTempDirSync() + "/nested/directory";
   await deno.mkdir(path, true);
   const pathInfo = deno.statSync(path);
diff --git a/js/read_dir_test.ts b/js/read_dir_test.ts
index d025c6ec5..77f33f714 100644
--- a/js/read_dir_test.ts
+++ b/js/read_dir_test.ts
@@ -1,5 +1,5 @@
 // Copyright 2018-2019 the Deno authors. All rights reserved. MIT license.
-import { test, testPerm, assert, assertEqual } from "./test_util.ts";
+import { testPerm, assert, assertEqual } from "./test_util.ts";
 import * as deno from "deno";
 import { FileInfo } from "deno";
 
@@ -22,12 +22,24 @@ function assertSameContent(files: FileInfo[]) {
   assertEqual(counter, 2);
 }
 
-test(function readDirSyncSuccess() {
+testPerm({ read: true }, function readDirSyncSuccess() {
   const files = deno.readDirSync("tests/");
   assertSameContent(files);
 });
 
-test(function readDirSyncNotDir() {
+testPerm({ read: false }, function readDirSyncPerm() {
+  let caughtError = false;
+  try {
+    const files = deno.readDirSync("tests/");
+  } catch (e) {
+    caughtError = true;
+    assertEqual(e.kind, deno.ErrorKind.PermissionDenied);
+    assertEqual(e.name, "PermissionDenied");
+  }
+  assert(caughtError);
+});
+
+testPerm({ read: true }, function readDirSyncNotDir() {
   let caughtError = false;
   let src;
 
@@ -41,7 +53,7 @@ test(function readDirSyncNotDir() {
   assertEqual(src, undefined);
 });
 
-test(function readDirSyncNotFound() {
+testPerm({ read: true }, function readDirSyncNotFound() {
   let caughtError = false;
   let src;
 
@@ -55,7 +67,19 @@ test(function readDirSyncNotFound() {
   assertEqual(src, undefined);
 });
 
-test(async function readDirSuccess() {
+testPerm({ read: true }, async function readDirSuccess() {
   const files = await deno.readDir("tests/");
   assertSameContent(files);
 });
+
+testPerm({ read: false }, async function readDirPerm() {
+  let caughtError = false;
+  try {
+    const files = await deno.readDir("tests/");
+  } catch (e) {
+    caughtError = true;
+    assertEqual(e.kind, deno.ErrorKind.PermissionDenied);
+    assertEqual(e.name, "PermissionDenied");
+  }
+  assert(caughtError);
+});
diff --git a/js/read_file_test.ts b/js/read_file_test.ts
index db35dd702..34b391345 100644
--- a/js/read_file_test.ts
+++ b/js/read_file_test.ts
@@ -1,8 +1,8 @@
 // Copyright 2018-2019 the Deno authors. All rights reserved. MIT license.
-import { test, assert, assertEqual } from "./test_util.ts";
+import { testPerm, assert, assertEqual } from "./test_util.ts";
 import * as deno from "deno";
 
-test(function readFileSyncSuccess() {
+testPerm({ read: true }, function readFileSyncSuccess() {
   const data = deno.readFileSync("package.json");
   assert(data.byteLength > 0);
   const decoder = new TextDecoder("utf-8");
@@ -11,7 +11,19 @@ test(function readFileSyncSuccess() {
   assertEqual(pkg.name, "deno");
 });
 
-test(function readFileSyncNotFound() {
+testPerm({ read: false }, function readFileSyncPerm() {
+  let caughtError = false;
+  try {
+    const data = deno.readFileSync("package.json");
+  } catch (e) {
+    caughtError = true;
+    assertEqual(e.kind, deno.ErrorKind.PermissionDenied);
+    assertEqual(e.name, "PermissionDenied");
+  }
+  assert(caughtError);
+});
+
+testPerm({ read: true }, function readFileSyncNotFound() {
   let caughtError = false;
   let data;
   try {
@@ -24,7 +36,7 @@ test(function readFileSyncNotFound() {
   assert(data === undefined);
 });
 
-test(async function readFileSuccess() {
+testPerm({ read: true }, async function readFileSuccess() {
   const data = await deno.readFile("package.json");
   assert(data.byteLength > 0);
   const decoder = new TextDecoder("utf-8");
@@ -32,3 +44,15 @@ test(async function readFileSuccess() {
   const pkg = JSON.parse(json);
   assertEqual(pkg.name, "deno");
 });
+
+testPerm({ read: false }, async function readFilePerm() {
+  let caughtError = false;
+  try {
+    await deno.readFile("package.json");
+  } catch (e) {
+    caughtError = true;
+    assertEqual(e.kind, deno.ErrorKind.PermissionDenied);
+    assertEqual(e.name, "PermissionDenied");
+  }
+  assert(caughtError);
+});
diff --git a/js/read_link_test.ts b/js/read_link_test.ts
index d4a2666b7..760ed1ea6 100644
--- a/js/read_link_test.ts
+++ b/js/read_link_test.ts
@@ -1,8 +1,8 @@
 // Copyright 2018-2019 the Deno authors. All rights reserved. MIT license.
-import { test, testPerm, assert, assertEqual } from "./test_util.ts";
+import { testPerm, assert, assertEqual } from "./test_util.ts";
 import * as deno from "deno";
 
-testPerm({ write: true }, function readlinkSyncSuccess() {
+testPerm({ write: true, read: true }, function readlinkSyncSuccess() {
   const testDir = deno.makeTempDirSync();
   const target = testDir + "/target";
   const symlink = testDir + "/symln";
@@ -16,7 +16,19 @@ testPerm({ write: true }, function readlinkSyncSuccess() {
   }
 });
 
-test(function readlinkSyncNotFound() {
+testPerm({ read: false }, async function readlinkSyncPerm() {
+  let caughtError = false;
+  try {
+    deno.readlinkSync("/symlink");
+  } catch (e) {
+    caughtError = true;
+    assertEqual(e.kind, deno.ErrorKind.PermissionDenied);
+    assertEqual(e.name, "PermissionDenied");
+  }
+  assert(caughtError);
+});
+
+testPerm({ read: true }, function readlinkSyncNotFound() {
   let caughtError = false;
   let data;
   try {
@@ -29,7 +41,7 @@ test(function readlinkSyncNotFound() {
   assertEqual(data, undefined);
 });
 
-testPerm({ write: true }, async function readlinkSuccess() {
+testPerm({ write: true, read: true }, async function readlinkSuccess() {
   const testDir = deno.makeTempDirSync();
   const target = testDir + "/target";
   const symlink = testDir + "/symln";
@@ -42,3 +54,15 @@ testPerm({ write: true }, async function readlinkSuccess() {
     assertEqual(targetPath, target);
   }
 });
+
+testPerm({ read: false }, async function readlinkPerm() {
+  let caughtError = false;
+  try {
+    await deno.readlink("/symlink");
+  } catch (e) {
+    caughtError = true;
+    assertEqual(e.kind, deno.ErrorKind.PermissionDenied);
+    assertEqual(e.name, "PermissionDenied");
+  }
+  assert(caughtError);
+});
diff --git a/js/rename_test.ts b/js/rename_test.ts
index bc08f006b..33c7d06ef 100644
--- a/js/rename_test.ts
+++ b/js/rename_test.ts
@@ -2,7 +2,7 @@
 import { testPerm, assert, assertEqual } from "./test_util.ts";
 import * as deno from "deno";
 
-testPerm({ write: true }, function renameSyncSuccess() {
+testPerm({ read: true, write: true }, function renameSyncSuccess() {
   const testDir = deno.makeTempDirSync();
   const oldpath = testDir + "/oldpath";
   const newpath = testDir + "/newpath";
@@ -24,7 +24,7 @@ testPerm({ write: true }, function renameSyncSuccess() {
   assertEqual(oldPathInfo, undefined);
 });
 
-testPerm({ write: false }, function renameSyncPerm() {
+testPerm({ read: true, write: false }, function renameSyncPerm() {
   let err;
   try {
     const oldpath = "/oldbaddir";
@@ -37,7 +37,7 @@ testPerm({ write: false }, function renameSyncPerm() {
   assertEqual(err.name, "PermissionDenied");
 });
 
-testPerm({ write: true }, async function renameSuccess() {
+testPerm({ read: true, write: true }, async function renameSuccess() {
   const testDir = deno.makeTempDirSync();
   const oldpath = testDir + "/oldpath";
   const newpath = testDir + "/newpath";
diff --git a/js/resources_test.ts b/js/resources_test.ts
index 7cfcbf1f8..722602c98 100644
--- a/js/resources_test.ts
+++ b/js/resources_test.ts
@@ -26,7 +26,7 @@ testPerm({ net: true }, async function resourcesNet() {
   listener.close();
 });
 
-test(async function resourcesFile() {
+testPerm({ read: true }, async function resourcesFile() {
   const resourcesBefore = deno.resources();
   await deno.open("tests/hello.txt");
   const resourcesAfter = deno.resources();
diff --git a/js/stat_test.ts b/js/stat_test.ts
index 19db81d37..21962f1b4 100644
--- a/js/stat_test.ts
+++ b/js/stat_test.ts
@@ -1,10 +1,10 @@
 // Copyright 2018-2019 the Deno authors. All rights reserved. MIT license.
-import { test, assert, assertEqual } from "./test_util.ts";
+import { testPerm, assert, assertEqual } from "./test_util.ts";
 import * as deno from "deno";
 
 // TODO Add tests for modified, accessed, and created fields once there is a way
 // to create temp files.
-test(async function statSyncSuccess() {
+testPerm({ read: true }, async function statSyncSuccess() {
   const packageInfo = deno.statSync("package.json");
   assert(packageInfo.isFile());
   assert(!packageInfo.isSymlink());
@@ -18,7 +18,19 @@ test(async function statSyncSuccess() {
   assert(!srcInfo.isSymlink());
 });
 
-test(async function statSyncNotFound() {
+testPerm({ read: false }, async function statSyncPerm() {
+  let caughtError = false;
+  try {
+    deno.statSync("package.json");
+  } catch (e) {
+    caughtError = true;
+    assertEqual(e.kind, deno.ErrorKind.PermissionDenied);
+    assertEqual(e.name, "PermissionDenied");
+  }
+  assert(caughtError);
+});
+
+testPerm({ read: true }, async function statSyncNotFound() {
   let caughtError = false;
   let badInfo;
 
@@ -34,7 +46,7 @@ test(async function statSyncNotFound() {
   assertEqual(badInfo, undefined);
 });
 
-test(async function lstatSyncSuccess() {
+testPerm({ read: true }, async function lstatSyncSuccess() {
   const packageInfo = deno.lstatSync("package.json");
   assert(packageInfo.isFile());
   assert(!packageInfo.isSymlink());
@@ -48,7 +60,19 @@ test(async function lstatSyncSuccess() {
   assert(!srcInfo.isSymlink());
 });
 
-test(async function lstatSyncNotFound() {
+testPerm({ read: false }, async function lstatSyncPerm() {
+  let caughtError = false;
+  try {
+    deno.lstatSync("package.json");
+  } catch (e) {
+    caughtError = true;
+    assertEqual(e.kind, deno.ErrorKind.PermissionDenied);
+    assertEqual(e.name, "PermissionDenied");
+  }
+  assert(caughtError);
+});
+
+testPerm({ read: true }, async function lstatSyncNotFound() {
   let caughtError = false;
   let badInfo;
 
@@ -64,7 +88,7 @@ test(async function lstatSyncNotFound() {
   assertEqual(badInfo, undefined);
 });
 
-test(async function statSuccess() {
+testPerm({ read: true }, async function statSuccess() {
   const packageInfo = await deno.stat("package.json");
   assert(packageInfo.isFile());
   assert(!packageInfo.isSymlink());
@@ -78,7 +102,19 @@ test(async function statSuccess() {
   assert(!srcInfo.isSymlink());
 });
 
-test(async function statNotFound() {
+testPerm({ read: false }, async function statPerm() {
+  let caughtError = false;
+  try {
+    await deno.stat("package.json");
+  } catch (e) {
+    caughtError = true;
+    assertEqual(e.kind, deno.ErrorKind.PermissionDenied);
+    assertEqual(e.name, "PermissionDenied");
+  }
+  assert(caughtError);
+});
+
+testPerm({ read: true }, async function statNotFound() {
   let caughtError = false;
   let badInfo;
 
@@ -94,7 +130,7 @@ test(async function statNotFound() {
   assertEqual(badInfo, undefined);
 });
 
-test(async function lstatSuccess() {
+testPerm({ read: true }, async function lstatSuccess() {
   const packageInfo = await deno.lstat("package.json");
   assert(packageInfo.isFile());
   assert(!packageInfo.isSymlink());
@@ -108,7 +144,19 @@ test(async function lstatSuccess() {
   assert(!srcInfo.isSymlink());
 });
 
-test(async function lstatNotFound() {
+testPerm({ read: false }, async function lstatPerm() {
+  let caughtError = false;
+  try {
+    await deno.lstat("package.json");
+  } catch (e) {
+    caughtError = true;
+    assertEqual(e.kind, deno.ErrorKind.PermissionDenied);
+    assertEqual(e.name, "PermissionDenied");
+  }
+  assert(caughtError);
+});
+
+testPerm({ read: true }, async function lstatNotFound() {
   let caughtError = false;
   let badInfo;
 
diff --git a/js/symlink_test.ts b/js/symlink_test.ts
index b552499f4..ab8463878 100644
--- a/js/symlink_test.ts
+++ b/js/symlink_test.ts
@@ -1,8 +1,8 @@
 // Copyright 2018-2019 the Deno authors. All rights reserved. MIT license.
-import { testPerm, assert, assertEqual } from "./test_util.ts";
+import { test, testPerm, assert, assertEqual } from "./test_util.ts";
 import * as deno from "deno";
 
-testPerm({ write: true }, function symlinkSyncSuccess() {
+testPerm({ read: true, write: true }, function symlinkSyncSuccess() {
   const testDir = deno.makeTempDirSync();
   const oldname = testDir + "/oldname";
   const newname = testDir + "/newname";
@@ -25,7 +25,7 @@ testPerm({ write: true }, function symlinkSyncSuccess() {
   }
 });
 
-testPerm({ write: false }, function symlinkSyncPerm() {
+test(function symlinkSyncPerm() {
   let err;
   try {
     deno.symlinkSync("oldbaddir", "newbaddir");
@@ -47,7 +47,7 @@ testPerm({ write: true }, function symlinkSyncNotImplemented() {
   assertEqual(err.message, "Not implemented");
 });
 
-testPerm({ write: true }, async function symlinkSuccess() {
+testPerm({ read: true, write: true }, async function symlinkSuccess() {
   const testDir = deno.makeTempDirSync();
   const oldname = testDir + "/oldname";
   const newname = testDir + "/newname";
diff --git a/js/test_util.ts b/js/test_util.ts
index d3af0f12e..6791a5f3b 100644
--- a/js/test_util.ts
+++ b/js/test_util.ts
@@ -18,6 +18,7 @@ export {
 testing.setFilter(deno.args[1]);
 
 interface DenoPermissions {
+  read?: boolean;
   write?: boolean;
   net?: boolean;
   env?: boolean;
@@ -25,24 +26,26 @@ interface DenoPermissions {
 }
 
 function permToString(perms: DenoPermissions): string {
+  const r = perms.read ? 1 : 0;
   const w = perms.write ? 1 : 0;
   const n = perms.net ? 1 : 0;
   const e = perms.env ? 1 : 0;
-  const r = perms.run ? 1 : 0;
-  return `permW${w}N${n}E${e}R${r}`;
+  const u = perms.run ? 1 : 0;
+  return `permR${r}W${w}N${n}E${e}U${u}`;
 }
 
 function permFromString(s: string): DenoPermissions {
-  const re = /^permW([01])N([01])E([01])R([01])$/;
+  const re = /^permR([01])W([01])N([01])E([01])U([01])$/;
   const found = s.match(re);
   if (!found) {
     throw Error("Not a permission string");
   }
   return {
-    write: Boolean(Number(found[1])),
-    net: Boolean(Number(found[2])),
-    env: Boolean(Number(found[3])),
-    run: Boolean(Number(found[4]))
+    read: Boolean(Number(found[1])),
+    write: Boolean(Number(found[2])),
+    net: Boolean(Number(found[3])),
+    env: Boolean(Number(found[4])),
+    run: Boolean(Number(found[5]))
   };
 }
 
@@ -52,7 +55,10 @@ export function testPerm(perms: DenoPermissions, fn: testing.TestFunction) {
 }
 
 export function test(fn: testing.TestFunction) {
-  testPerm({ write: false, net: false, env: false, run: false }, fn);
+  testPerm(
+    { read: false, write: false, net: false, env: false, run: false },
+    fn
+  );
 }
 
 test(function permSerialization() {
@@ -60,8 +66,10 @@ test(function permSerialization() {
     for (const net of [true, false]) {
       for (const env of [true, false]) {
         for (const run of [true, false]) {
-          const perms: DenoPermissions = { write, net, env, run };
-          testing.assertEqual(perms, permFromString(permToString(perms)));
+          for (const read of [true, false]) {
+            const perms: DenoPermissions = { write, net, env, run, read };
+            testing.assertEqual(perms, permFromString(permToString(perms)));
+          }
         }
       }
     }
diff --git a/js/truncate_test.ts b/js/truncate_test.ts
index c0e1b163b..2556dc76a 100644
--- a/js/truncate_test.ts
+++ b/js/truncate_test.ts
@@ -16,7 +16,7 @@ async function readData(name: string): Promise<string> {
   return text;
 }
 
-testPerm({ write: true }, function truncateSyncSuccess() {
+testPerm({ read: true, write: true }, function truncateSyncSuccess() {
   const enc = new TextEncoder();
   const d = enc.encode("Hello");
   const filename = deno.makeTempDirSync() + "/test_truncateSync.txt";
@@ -33,7 +33,7 @@ testPerm({ write: true }, function truncateSyncSuccess() {
   deno.removeSync(filename);
 });
 
-testPerm({ write: true }, async function truncateSuccess() {
+testPerm({ read: true, write: true }, async function truncateSuccess() {
   const enc = new TextEncoder();
   const d = enc.encode("Hello");
   const filename = deno.makeTempDirSync() + "/test_truncate.txt";
diff --git a/js/write_file_test.ts b/js/write_file_test.ts
index 7a43dec62..39f191842 100644
--- a/js/write_file_test.ts
+++ b/js/write_file_test.ts
@@ -2,7 +2,7 @@
 import { testPerm, assert, assertEqual } from "./test_util.ts";
 import * as deno from "deno";
 
-testPerm({ write: true }, function writeFileSyncSuccess() {
+testPerm({ read: true, write: true }, function writeFileSyncSuccess() {
   const enc = new TextEncoder();
   const data = enc.encode("Hello");
   const filename = deno.makeTempDirSync() + "/test.txt";
@@ -45,7 +45,7 @@ testPerm({ write: false }, function writeFileSyncPerm() {
   assert(caughtError);
 });
 
-testPerm({ write: true }, function writeFileSyncUpdatePerm() {
+testPerm({ read: true, write: true }, function writeFileSyncUpdatePerm() {
   if (deno.platform.os !== "win") {
     const enc = new TextEncoder();
     const data = enc.encode("Hello");
@@ -57,7 +57,7 @@ testPerm({ write: true }, function writeFileSyncUpdatePerm() {
   }
 });
 
-testPerm({ write: true }, function writeFileSyncCreate() {
+testPerm({ read: true, write: true }, function writeFileSyncCreate() {
   const enc = new TextEncoder();
   const data = enc.encode("Hello");
   const filename = deno.makeTempDirSync() + "/test.txt";
@@ -81,7 +81,7 @@ testPerm({ write: true }, function writeFileSyncCreate() {
   assertEqual("Hello", actual);
 });
 
-testPerm({ write: true }, function writeFileSyncAppend() {
+testPerm({ read: true, write: true }, function writeFileSyncAppend() {
   const enc = new TextEncoder();
   const data = enc.encode("Hello");
   const filename = deno.makeTempDirSync() + "/test.txt";
@@ -103,7 +103,7 @@ testPerm({ write: true }, function writeFileSyncAppend() {
   assertEqual("Hello", actual);
 });
 
-testPerm({ write: true }, async function writeFileSuccess() {
+testPerm({ read: true, write: true }, async function writeFileSuccess() {
   const enc = new TextEncoder();
   const data = enc.encode("Hello");
   const filename = deno.makeTempDirSync() + "/test.txt";
@@ -114,7 +114,7 @@ testPerm({ write: true }, async function writeFileSuccess() {
   assertEqual("Hello", actual);
 });
 
-testPerm({ write: true }, async function writeFileNotFound() {
+testPerm({ read: true, write: true }, async function writeFileNotFound() {
   const enc = new TextEncoder();
   const data = enc.encode("Hello");
   const filename = "/baddir/test.txt";
@@ -130,7 +130,7 @@ testPerm({ write: true }, async function writeFileNotFound() {
   assert(caughtError);
 });
 
-testPerm({ write: false }, async function writeFilePerm() {
+testPerm({ read: true, write: false }, async function writeFilePerm() {
   const enc = new TextEncoder();
   const data = enc.encode("Hello");
   const filename = "/baddir/test.txt";
@@ -146,7 +146,7 @@ testPerm({ write: false }, async function writeFilePerm() {
   assert(caughtError);
 });
 
-testPerm({ write: true }, async function writeFileUpdatePerm() {
+testPerm({ read: true, write: true }, async function writeFileUpdatePerm() {
   if (deno.platform.os !== "win") {
     const enc = new TextEncoder();
     const data = enc.encode("Hello");
@@ -158,7 +158,7 @@ testPerm({ write: true }, async function writeFileUpdatePerm() {
   }
 });
 
-testPerm({ write: true }, async function writeFileCreate() {
+testPerm({ read: true, write: true }, async function writeFileCreate() {
   const enc = new TextEncoder();
   const data = enc.encode("Hello");
   const filename = deno.makeTempDirSync() + "/test.txt";
@@ -182,7 +182,7 @@ testPerm({ write: true }, async function writeFileCreate() {
   assertEqual("Hello", actual);
 });
 
-testPerm({ write: true }, async function writeFileAppend() {
+testPerm({ read: true, write: true }, async function writeFileAppend() {
   const enc = new TextEncoder();
   const data = enc.encode("Hello");
   const filename = deno.makeTempDirSync() + "/test.txt";