feat: Add requesting API name to permission prompt (#15936)

Co-authored-by: Leo Kettmeir <crowlkats@toaxl.com>

6 files changed, 209 insertions, 89 deletions

diff --git a/runtime/ops/fs.rs b/runtime/ops/fs.rs
index f5e96e7e2..9b0737fe9 100644
--- a/runtime/ops/fs.rs
+++ b/runtime/ops/fs.rs
@@ -126,6 +126,7 @@ fn open_helper(
   path: &str,
   mode: Option<u32>,
   options: Option<&OpenOptions>,
+  api_name: &str,
 ) -> Result<(PathBuf, std::fs::OpenOptions), AnyError> {
   let path = Path::new(path).to_path_buf();
 
@@ -147,7 +148,7 @@ fn open_helper(
 
   match options {
     None => {
-      permissions.read.check(&path)?;
+      permissions.read.check(&path, Some(api_name))?;
       open_options
         .read(true)
         .create(false)
@@ -158,11 +159,11 @@ fn open_helper(
     }
     Some(options) => {
       if options.read {
-        permissions.read.check(&path)?;
+        permissions.read.check(&path, Some(api_name))?;
       }
 
       if options.write || options.append {
-        permissions.write.check(&path)?;
+        permissions.write.check(&path, Some(api_name))?;
       }
 
       open_options
@@ -185,7 +186,8 @@ fn op_open_sync(
   options: Option<OpenOptions>,
   mode: Option<u32>,
 ) -> Result<ResourceId, AnyError> {
-  let (path, open_options) = open_helper(state, &path, mode, options.as_ref())?;
+  let (path, open_options) =
+    open_helper(state, &path, mode, options.as_ref(), "Deno.openSync()")?;
   let std_file = open_options.open(&path).map_err(|err| {
     Error::new(err.kind(), format!("{}, open '{}'", err, path.display()))
   })?;
@@ -201,8 +203,13 @@ async fn op_open_async(
   options: Option<OpenOptions>,
   mode: Option<u32>,
 ) -> Result<ResourceId, AnyError> {
-  let (path, open_options) =
-    open_helper(&mut state.borrow_mut(), &path, mode, options.as_ref())?;
+  let (path, open_options) = open_helper(
+    &mut state.borrow_mut(),
+    &path,
+    mode,
+    options.as_ref(),
+    "Deno.open()",
+  )?;
   let std_file = tokio::task::spawn_blocking(move || {
     open_options.open(path.clone()).map_err(|err| {
       Error::new(err.kind(), format!("{}, open '{}'", err, path.display()))
@@ -240,6 +247,7 @@ fn op_write_file_sync(
     &path,
     mode,
     Some(&write_open_options(create, append)),
+    "Deno.writeFileSync()",
   )?;
   write_file(&path, open_options, mode, data)
 }
@@ -267,6 +275,7 @@ async fn op_write_file_async(
     &path,
     mode,
     Some(&write_open_options(create, append)),
+    "Deno.writeFile()",
   )?;
   let write_future = tokio::task::spawn_blocking(move || {
     write_file(&path, open_options, mode, data)
@@ -517,7 +526,10 @@ fn op_umask(state: &mut OpState, mask: Option<u32>) -> Result<u32, AnyError> {
 #[op]
 fn op_chdir(state: &mut OpState, directory: String) -> Result<(), AnyError> {
   let d = PathBuf::from(&directory);
-  state.borrow_mut::<Permissions>().read.check(&d)?;
+  state
+    .borrow_mut::<Permissions>()
+    .read
+    .check(&d, Some("Deno.chdir()"))?;
   set_current_dir(&d).map_err(|err| {
     Error::new(err.kind(), format!("{}, chdir '{}'", err, directory))
   })?;
@@ -536,7 +548,10 @@ pub struct MkdirArgs {
 fn op_mkdir_sync(state: &mut OpState, args: MkdirArgs) -> Result<(), AnyError> {
   let path = Path::new(&args.path).to_path_buf();
   let mode = args.mode.unwrap_or(0o777) & 0o777;
-  state.borrow_mut::<Permissions>().write.check(&path)?;
+  state
+    .borrow_mut::<Permissions>()
+    .write
+    .check(&path, Some("Deno.mkdirSync()"))?;
   debug!("op_mkdir {} {:o} {}", path.display(), mode, args.recursive);
   let mut builder = std::fs::DirBuilder::new();
   builder.recursive(args.recursive);
@@ -561,7 +576,10 @@ async fn op_mkdir_async(
 
   {
     let mut state = state.borrow_mut();
-    state.borrow_mut::<Permissions>().write.check(&path)?;
+    state
+      .borrow_mut::<Permissions>()
+      .write
+      .check(&path, Some("Deno.mkdir()"))?;
   }
 
   tokio::task::spawn_blocking(move || {
@@ -591,7 +609,10 @@ fn op_chmod_sync(
   let path = Path::new(&path);
   let mode = mode & 0o777;
 
-  state.borrow_mut::<Permissions>().write.check(path)?;
+  state
+    .borrow_mut::<Permissions>()
+    .write
+    .check(path, Some("Deno.chmodSync()"))?;
   raw_chmod(path, mode)
 }
 
@@ -606,7 +627,10 @@ async fn op_chmod_async(
 
   {
     let mut state = state.borrow_mut();
-    state.borrow_mut::<Permissions>().write.check(&path)?;
+    state
+      .borrow_mut::<Permissions>()
+      .write
+      .check(&path, Some("Deno.chmod()"))?;
   }
 
   tokio::task::spawn_blocking(move || raw_chmod(&path, mode))
@@ -642,7 +666,10 @@ fn op_chown_sync(
   #[cfg_attr(windows, allow(unused_variables))] gid: Option<u32>,
 ) -> Result<(), AnyError> {
   let path = Path::new(&path).to_path_buf();
-  state.borrow_mut::<Permissions>().write.check(&path)?;
+  state
+    .borrow_mut::<Permissions>()
+    .write
+    .check(&path, Some("Deno.chownSync()"))?;
   #[cfg(unix)]
   {
     use crate::errors::get_nix_error_class;
@@ -675,7 +702,10 @@ async fn op_chown_async(
 
   {
     let mut state = state.borrow_mut();
-    state.borrow_mut::<Permissions>().write.check(&path)?;
+    state
+      .borrow_mut::<Permissions>()
+      .write
+      .check(&path, Some("Deno.chown()"))?;
   }
 
   tokio::task::spawn_blocking(move || {
@@ -709,7 +739,10 @@ fn op_remove_sync(
 ) -> Result<(), AnyError> {
   let path = PathBuf::from(&path);
 
-  state.borrow_mut::<Permissions>().write.check(&path)?;
+  state
+    .borrow_mut::<Permissions>()
+    .write
+    .check(&path, Some("Deno.removeSync()"))?;
 
   #[cfg(not(unix))]
   use std::os::windows::prelude::MetadataExt;
@@ -755,7 +788,10 @@ async fn op_remove_async(
 
   {
     let mut state = state.borrow_mut();
-    state.borrow_mut::<Permissions>().write.check(&path)?;
+    state
+      .borrow_mut::<Permissions>()
+      .write
+      .check(&path, Some("Deno.remove()"))?;
   }
 
   tokio::task::spawn_blocking(move || {
@@ -806,8 +842,12 @@ fn op_copy_file_sync(
   let to_path = PathBuf::from(&to);
 
   let permissions = state.borrow_mut::<Permissions>();
-  permissions.read.check(&from_path)?;
-  permissions.write.check(&to_path)?;
+  permissions
+    .read
+    .check(&from_path, Some("Deno.copyFileSync()"))?;
+  permissions
+    .write
+    .check(&to_path, Some("Deno.copyFileSync()"))?;
 
   // On *nix, Rust reports non-existent `from` as ErrorKind::InvalidInput
   // See https://github.com/rust-lang/rust/issues/54800
@@ -903,8 +943,8 @@ async fn op_copy_file_async(
   {
     let mut state = state.borrow_mut();
     let permissions = state.borrow_mut::<Permissions>();
-    permissions.read.check(&from)?;
-    permissions.write.check(&to)?;
+    permissions.read.check(&from, Some("Deno.copyFile()"))?;
+    permissions.write.check(&to, Some("Deno.copyFile()"))?;
   }
 
   tokio::task::spawn_blocking(move || {
@@ -1062,7 +1102,10 @@ fn op_stat_sync(
   out_buf: &mut [u32],
 ) -> Result<(), AnyError> {
   let path = PathBuf::from(&path);
-  state.borrow_mut::<Permissions>().read.check(&path)?;
+  state
+    .borrow_mut::<Permissions>()
+    .read
+    .check(&path, Some("Deno.statSync()"))?;
   let err_mapper = |err: Error| {
     Error::new(err.kind(), format!("{}, stat '{}'", err, path.display()))
   };
@@ -1088,7 +1131,10 @@ async fn op_stat_async(
 
   {
     let mut state = state.borrow_mut();
-    state.borrow_mut::<Permissions>().read.check(&path)?;
+    state
+      .borrow_mut::<Permissions>()
+      .read
+      .check(&path, Some("Deno.stat()"))?;
   }
 
   tokio::task::spawn_blocking(move || {
@@ -1115,9 +1161,13 @@ fn op_realpath_sync(
   let path = PathBuf::from(&path);
 
   let permissions = state.borrow_mut::<Permissions>();
-  permissions.read.check(&path)?;
+  permissions.read.check(&path, Some("Deno.realPathSync()"))?;
   if path.is_relative() {
-    permissions.read.check_blind(&current_dir()?, "CWD")?;
+    permissions.read.check_blind(
+      &current_dir()?,
+      "CWD",
+      "Deno.realPathSync()",
+    )?;
   }
 
   debug!("op_realpath_sync {}", path.display());
@@ -1138,9 +1188,13 @@ async fn op_realpath_async(
   {
     let mut state = state.borrow_mut();
     let permissions = state.borrow_mut::<Permissions>();
-    permissions.read.check(&path)?;
+    permissions.read.check(&path, Some("Deno.realPath()"))?;
     if path.is_relative() {
-      permissions.read.check_blind(&current_dir()?, "CWD")?;
+      permissions.read.check_blind(
+        &current_dir()?,
+        "CWD",
+        "Deno.realPath()",
+      )?;
     }
   }
 
@@ -1172,7 +1226,10 @@ fn op_read_dir_sync(
 ) -> Result<Vec<DirEntry>, AnyError> {
   let path = PathBuf::from(&path);
 
-  state.borrow_mut::<Permissions>().read.check(&path)?;
+  state
+    .borrow_mut::<Permissions>()
+    .read
+    .check(&path, Some("Deno.readDirSync()"))?;
 
   debug!("op_read_dir_sync {}", path.display());
   let err_mapper = |err: Error| {
@@ -1213,7 +1270,10 @@ async fn op_read_dir_async(
   let path = PathBuf::from(&path);
   {
     let mut state = state.borrow_mut();
-    state.borrow_mut::<Permissions>().read.check(&path)?;
+    state
+      .borrow_mut::<Permissions>()
+      .read
+      .check(&path, Some("Deno.readDir()"))?;
   }
   tokio::task::spawn_blocking(move || {
     debug!("op_read_dir_async {}", path.display());
@@ -1260,9 +1320,15 @@ fn op_rename_sync(
   let newpath = PathBuf::from(&newpath);
 
   let permissions = state.borrow_mut::<Permissions>();
-  permissions.read.check(&oldpath)?;
-  permissions.write.check(&oldpath)?;
-  permissions.write.check(&newpath)?;
+  permissions
+    .read
+    .check(&oldpath, Some("Deno.renameSync()"))?;
+  permissions
+    .write
+    .check(&oldpath, Some("Deno.renameSync()"))?;
+  permissions
+    .write
+    .check(&newpath, Some("Deno.renameSync()"))?;
 
   let err_mapper = |err: Error| {
     Error::new(
@@ -1290,9 +1356,9 @@ async fn op_rename_async(
   {
     let mut state = state.borrow_mut();
     let permissions = state.borrow_mut::<Permissions>();
-    permissions.read.check(&oldpath)?;
-    permissions.write.check(&oldpath)?;
-    permissions.write.check(&newpath)?;
+    permissions.read.check(&oldpath, Some("Deno.rename()"))?;
+    permissions.write.check(&oldpath, Some("Deno.rename()"))?;
+    permissions.write.check(&newpath, Some("Deno.rename()"))?;
   }
   tokio::task::spawn_blocking(move || {
     let err_mapper = |err: Error| {
@@ -1323,10 +1389,10 @@ fn op_link_sync(
   let newpath = PathBuf::from(&newpath);
 
   let permissions = state.borrow_mut::<Permissions>();
-  permissions.read.check(&oldpath)?;
-  permissions.write.check(&oldpath)?;
-  permissions.read.check(&newpath)?;
-  permissions.write.check(&newpath)?;
+  permissions.read.check(&oldpath, Some("Deno.linkSync()"))?;
+  permissions.write.check(&oldpath, Some("Deno.linkSync()"))?;
+  permissions.read.check(&newpath, Some("Deno.linkSync()"))?;
+  permissions.write.check(&newpath, Some("Deno.linkSync()"))?;
 
   let err_mapper = |err: Error| {
     Error::new(
@@ -1355,10 +1421,10 @@ async fn op_link_async(
   {
     let mut state = state.borrow_mut();
     let permissions = state.borrow_mut::<Permissions>();
-    permissions.read.check(&oldpath)?;
-    permissions.write.check(&oldpath)?;
-    permissions.read.check(&newpath)?;
-    permissions.write.check(&newpath)?;
+    permissions.read.check(&oldpath, Some("Deno.link()"))?;
+    permissions.write.check(&oldpath, Some("Deno.link()"))?;
+    permissions.read.check(&newpath, Some("Deno.link()"))?;
+    permissions.write.check(&newpath, Some("Deno.link()"))?;
   }
 
   tokio::task::spawn_blocking(move || {
@@ -1390,8 +1456,14 @@ fn op_symlink_sync(
   let oldpath = PathBuf::from(&oldpath);
   let newpath = PathBuf::from(&newpath);
 
-  state.borrow_mut::<Permissions>().write.check_all()?;
-  state.borrow_mut::<Permissions>().read.check_all()?;
+  state
+    .borrow_mut::<Permissions>()
+    .write
+    .check_all(Some("Deno.symlinkSync()"))?;
+  state
+    .borrow_mut::<Permissions>()
+    .read
+    .check_all(Some("Deno.symlinkSync()"))?;
 
   let err_mapper = |err: Error| {
     Error::new(
@@ -1450,8 +1522,14 @@ async fn op_symlink_async(
 
   {
     let mut state = state.borrow_mut();
-    state.borrow_mut::<Permissions>().write.check_all()?;
-    state.borrow_mut::<Permissions>().read.check_all()?;
+    state
+      .borrow_mut::<Permissions>()
+      .write
+      .check_all(Some("Deno.symlink()"))?;
+    state
+      .borrow_mut::<Permissions>()
+      .read
+      .check_all(Some("Deno.symlink()"))?;
   }
 
   tokio::task::spawn_blocking(move || {
@@ -1510,7 +1588,10 @@ fn op_read_link_sync(
 ) -> Result<String, AnyError> {
   let path = PathBuf::from(&path);
 
-  state.borrow_mut::<Permissions>().read.check(&path)?;
+  state
+    .borrow_mut::<Permissions>()
+    .read
+    .check(&path, Some("Deno.readLink()"))?;
 
   debug!("op_read_link_value {}", path.display());
   let err_mapper = |err: Error| {
@@ -1534,7 +1615,10 @@ async fn op_read_link_async(
   let path = PathBuf::from(&path);
   {
     let mut state = state.borrow_mut();
-    state.borrow_mut::<Permissions>().read.check(&path)?;
+    state
+      .borrow_mut::<Permissions>()
+      .read
+      .check(&path, Some("Deno.readLink()"))?;
   }
   tokio::task::spawn_blocking(move || {
     debug!("op_read_link_async {}", path.display());
@@ -1590,7 +1674,10 @@ fn op_truncate_sync(
 ) -> Result<(), AnyError> {
   let path = PathBuf::from(&path);
 
-  state.borrow_mut::<Permissions>().write.check(&path)?;
+  state
+    .borrow_mut::<Permissions>()
+    .write
+    .check(&path, Some("Deno.truncateSync()"))?;
 
   debug!("op_truncate_sync {} {}", path.display(), len);
   let err_mapper = |err: Error| {
@@ -1617,7 +1704,10 @@ async fn op_truncate_async(
 
   {
     let mut state = state.borrow_mut();
-    state.borrow_mut::<Permissions>().write.check(&path)?;
+    state
+      .borrow_mut::<Permissions>()
+      .write
+      .check(&path, Some("Deno.truncate()"))?;
   }
   tokio::task::spawn_blocking(move || {
     debug!("op_truncate_async {} {}", path.display(), len);
@@ -1700,10 +1790,10 @@ fn op_make_temp_dir_sync(
   let prefix = args.prefix.map(String::from);
   let suffix = args.suffix.map(String::from);
 
-  state
-    .borrow_mut::<Permissions>()
-    .write
-    .check(dir.clone().unwrap_or_else(temp_dir).as_path())?;
+  state.borrow_mut::<Permissions>().write.check(
+    dir.clone().unwrap_or_else(temp_dir).as_path(),
+    Some("Deno.makeTempDirSync()"),
+  )?;
 
   // TODO(piscisaureus): use byte vector for paths, not a string.
   // See https://github.com/denoland/deno/issues/627.
@@ -1730,10 +1820,10 @@ async fn op_make_temp_dir_async(
   let suffix = args.suffix.map(String::from);
   {
     let mut state = state.borrow_mut();
-    state
-      .borrow_mut::<Permissions>()
-      .write
-      .check(dir.clone().unwrap_or_else(temp_dir).as_path())?;
+    state.borrow_mut::<Permissions>().write.check(
+      dir.clone().unwrap_or_else(temp_dir).as_path(),
+      Some("Deno.makeTempDir()"),
+    )?;
   }
   tokio::task::spawn_blocking(move || {
     // TODO(piscisaureus): use byte vector for paths, not a string.
@@ -1763,10 +1853,10 @@ fn op_make_temp_file_sync(
   let prefix = args.prefix.map(String::from);
   let suffix = args.suffix.map(String::from);
 
-  state
-    .borrow_mut::<Permissions>()
-    .write
-    .check(dir.clone().unwrap_or_else(temp_dir).as_path())?;
+  state.borrow_mut::<Permissions>().write.check(
+    dir.clone().unwrap_or_else(temp_dir).as_path(),
+    Some("Deno.makeTempFileSync()"),
+  )?;
 
   // TODO(piscisaureus): use byte vector for paths, not a string.
   // See https://github.com/denoland/deno/issues/627.
@@ -1793,10 +1883,10 @@ async fn op_make_temp_file_async(
   let suffix = args.suffix.map(String::from);
   {
     let mut state = state.borrow_mut();
-    state
-      .borrow_mut::<Permissions>()
-      .write
-      .check(dir.clone().unwrap_or_else(temp_dir).as_path())?;
+    state.borrow_mut::<Permissions>().write.check(
+      dir.clone().unwrap_or_else(temp_dir).as_path(),
+      Some("Deno.makeTempFile()"),
+    )?;
   }
   tokio::task::spawn_blocking(move || {
     // TODO(piscisaureus): use byte vector for paths, not a string.
@@ -1873,7 +1963,10 @@ fn op_utime_sync(
   let atime = filetime::FileTime::from_unix_time(atime_secs, atime_nanos);
   let mtime = filetime::FileTime::from_unix_time(mtime_secs, mtime_nanos);
 
-  state.borrow_mut::<Permissions>().write.check(&path)?;
+  state
+    .borrow_mut::<Permissions>()
+    .write
+    .check(&path, Some("Deno.utime()"))?;
   filetime::set_file_times(&path, atime, mtime).map_err(|err| {
     Error::new(err.kind(), format!("{}, utime '{}'", err, path.display()))
   })?;
@@ -1899,7 +1992,7 @@ async fn op_utime_async(
     .borrow_mut()
     .borrow_mut::<Permissions>()
     .write
-    .check(&path)?;
+    .check(&path, Some("Deno.utime()"))?;
 
   tokio::task::spawn_blocking(move || {
     filetime::set_file_times(&path, atime, mtime).map_err(|err| {
@@ -1914,10 +2007,11 @@ async fn op_utime_async(
 #[op]
 fn op_cwd(state: &mut OpState) -> Result<String, AnyError> {
   let path = current_dir()?;
-  state
-    .borrow_mut::<Permissions>()
-    .read
-    .check_blind(&path, "CWD")?;
+  state.borrow_mut::<Permissions>().read.check_blind(
+    &path,
+    "CWD",
+    "Deno.cwd()",
+  )?;
   let path_str = into_string(path.into_os_string())?;
   Ok(path_str)
 }
@@ -1929,7 +2023,7 @@ fn op_readfile_sync(
 ) -> Result<ZeroCopyBuf, AnyError> {
   let permissions = state.borrow_mut::<Permissions>();
   let path = Path::new(&path);
-  permissions.read.check(path)?;
+  permissions.read.check(path, Some("Deno.readFileSync()"))?;
   Ok(std::fs::read(path)?.into())
 }
 
@@ -1940,7 +2034,9 @@ fn op_readfile_text_sync(
 ) -> Result<String, AnyError> {
   let permissions = state.borrow_mut::<Permissions>();
   let path = Path::new(&path);
-  permissions.read.check(path)?;
+  permissions
+    .read
+    .check(path, Some("Deno.readTextFileSync()"))?;
   Ok(string_from_utf8_lossy(std::fs::read(path)?))
 }
 
@@ -1953,7 +2049,10 @@ async fn op_readfile_async(
   {
     let path = Path::new(&path);
     let mut state = state.borrow_mut();
-    state.borrow_mut::<Permissions>().read.check(path)?;
+    state
+      .borrow_mut::<Permissions>()
+      .read
+      .check(path, Some("Deno.readFile()"))?;
   }
   let fut = tokio::task::spawn_blocking(move || {
     let path = Path::new(&path);
@@ -1980,7 +2079,10 @@ async fn op_readfile_text_async(
   {
     let path = Path::new(&path);
     let mut state = state.borrow_mut();
-    state.borrow_mut::<Permissions>().read.check(path)?;
+    state
+      .borrow_mut::<Permissions>()
+      .read
+      .check(path, Some("Deno.readTextFile()"))?;
   }
   let fut = tokio::task::spawn_blocking(move || {
     let path = Path::new(&path);
diff --git a/runtime/ops/fs_events.rs b/runtime/ops/fs_events.rs
index 5e185c4bc..6c631bb59 100644
--- a/runtime/ops/fs_events.rs
+++ b/runtime/ops/fs_events.rs
@@ -118,7 +118,10 @@ fn op_fs_events_open(
   };
   for path in &args.paths {
     let path = PathBuf::from(path);
-    state.borrow_mut::<Permissions>().read.check(&path)?;
+    state
+      .borrow_mut::<Permissions>()
+      .read
+      .check(&path, Some("Deno.watchFs()"))?;
     watcher.watch(&path, recursive_mode)?;
   }
   let resource = FsEventsResource {
diff --git a/runtime/ops/os.rs b/runtime/ops/os.rs
index 70d429839..14c4229a1 100644
--- a/runtime/ops/os.rs
+++ b/runtime/ops/os.rs
@@ -61,10 +61,11 @@ fn noop_op() -> Result<(), AnyError> {
 #[op]
 fn op_exec_path(state: &mut OpState) -> Result<String, AnyError> {
   let current_exe = env::current_exe().unwrap();
-  state
-    .borrow_mut::<Permissions>()
-    .read
-    .check_blind(&current_exe, "exec_path")?;
+  state.borrow_mut::<Permissions>().read.check_blind(
+    &current_exe,
+    "exec_path",
+    "Deno.execPath()",
+  )?;
   // Now apply URL parser to current exe to get fully resolved path, otherwise
   // we might get `./` and `../` bits in `exec_path`
   let exe_url = Url::from_file_path(current_exe).unwrap();
diff --git a/runtime/ops/process.rs b/runtime/ops/process.rs
index e4b614030..88c130e61 100644
--- a/runtime/ops/process.rs
+++ b/runtime/ops/process.rs
@@ -144,7 +144,10 @@ struct RunInfo {
 #[op]
 fn op_run(state: &mut OpState, run_args: RunArgs) -> Result<RunInfo, AnyError> {
   let args = run_args.cmd;
-  state.borrow_mut::<Permissions>().run.check(&args[0])?;
+  state
+    .borrow_mut::<Permissions>()
+    .run
+    .check(&args[0], Some("Deno.run()"))?;
   let env = run_args.env;
   let cwd = run_args.cwd;
 
@@ -348,8 +351,12 @@ fn op_kill(
   state: &mut OpState,
   pid: i32,
   signal: String,
+  api_name: String,
 ) -> Result<(), AnyError> {
-  state.borrow_mut::<Permissions>().run.check_all()?;
+  state
+    .borrow_mut::<Permissions>()
+    .run
+    .check_all(Some(&api_name))?;
   kill(pid, &signal)?;
   Ok(())
 }
diff --git a/runtime/ops/runtime.rs b/runtime/ops/runtime.rs
index d12dfab96..f6ae0146c 100644
--- a/runtime/ops/runtime.rs
+++ b/runtime/ops/runtime.rs
@@ -26,10 +26,11 @@ fn op_main_module(state: &mut OpState) -> Result<String, AnyError> {
     let main_path = std::env::current_dir()
       .context("Failed to get current working directory")?
       .join(main_url.to_string());
-    state
-      .borrow_mut::<Permissions>()
-      .read
-      .check_blind(&main_path, "main_module")?;
+    state.borrow_mut::<Permissions>().read.check_blind(
+      &main_path,
+      "main_module",
+      "Deno.mainModule",
+    )?;
   }
   Ok(main)
 }
diff --git a/runtime/ops/spawn.rs b/runtime/ops/spawn.rs
index b337f2488..9286e6d0c 100644
--- a/runtime/ops/spawn.rs
+++ b/runtime/ops/spawn.rs
@@ -122,9 +122,13 @@ pub struct SpawnOutput {
 fn create_command(
   state: &mut OpState,
   args: SpawnArgs,
+  api_name: &str,
 ) -> Result<std::process::Command, AnyError> {
   super::check_unstable(state, "Deno.spawn");
-  state.borrow_mut::<Permissions>().run.check(&args.cmd)?;
+  state
+    .borrow_mut::<Permissions>()
+    .run
+    .check(&args.cmd, Some(api_name))?;
 
   let mut command = std::process::Command::new(args.cmd);
   command.args(args.args);
@@ -185,8 +189,10 @@ struct Child {
 fn op_spawn_child(
   state: &mut OpState,
   args: SpawnArgs,
+  api_name: String,
 ) -> Result<Child, AnyError> {
-  let mut command = tokio::process::Command::from(create_command(state, args)?);
+  let mut command =
+    tokio::process::Command::from(create_command(state, args, &api_name)?);
   // TODO(@crowlkats): allow detaching processes.
   //  currently deno will orphan a process when exiting with an error or Deno.exit()
   // We want to kill child when it's closed
@@ -246,7 +252,7 @@ fn op_spawn_sync(
 ) -> Result<SpawnOutput, AnyError> {
   let stdout = matches!(args.stdio.stdout, Stdio::Piped);
   let stderr = matches!(args.stdio.stderr, Stdio::Piped);
-  let output = create_command(state, args)?.output()?;
+  let output = create_command(state, args, "Deno.spawnSync()")?.output()?;
 
   Ok(SpawnOutput {
     status: output.status.try_into()?,