feat(runtime/permissions): prompt fallback (#9376)

Co-authored-by: Yoshiya Hinosawa <stibium121@gmail.com>
Co-authored-by: Bartek Iwańczuk <biwanczuk@gmail.com>

9 files changed, 97 insertions, 84 deletions

diff --git a/runtime/ops/fs.rs b/runtime/ops/fs.rs
index a084fdb15..0753ea0fb 100644
--- a/runtime/ops/fs.rs
+++ b/runtime/ops/fs.rs
@@ -149,7 +149,7 @@ fn open_helper(
     let _ = mode; // avoid unused warning
   }
 
-  let permissions = state.borrow::<Permissions>();
+  let permissions = state.borrow_mut::<Permissions>();
   let options = args.options;
 
   if options.read {
@@ -409,7 +409,7 @@ fn op_chdir(
   _zero_copy: Option<ZeroCopyBuf>,
 ) -> Result<(), AnyError> {
   let d = PathBuf::from(&directory);
-  state.borrow::<Permissions>().read.check(&d)?;
+  state.borrow_mut::<Permissions>().read.check(&d)?;
   set_current_dir(&d)?;
   Ok(())
 }
@@ -429,7 +429,7 @@ fn op_mkdir_sync(
 ) -> Result<(), AnyError> {
   let path = Path::new(&args.path).to_path_buf();
   let mode = args.mode.unwrap_or(0o777) & 0o777;
-  state.borrow::<Permissions>().write.check(&path)?;
+  state.borrow_mut::<Permissions>().write.check(&path)?;
   debug!("op_mkdir {} {:o} {}", path.display(), mode, args.recursive);
   let mut builder = std::fs::DirBuilder::new();
   builder.recursive(args.recursive);
@@ -451,8 +451,8 @@ async fn op_mkdir_async(
   let mode = args.mode.unwrap_or(0o777) & 0o777;
 
   {
-    let state = state.borrow();
-    state.borrow::<Permissions>().write.check(&path)?;
+    let mut state = state.borrow_mut();
+    state.borrow_mut::<Permissions>().write.check(&path)?;
   }
 
   tokio::task::spawn_blocking(move || {
@@ -486,7 +486,7 @@ fn op_chmod_sync(
   let path = Path::new(&args.path).to_path_buf();
   let mode = args.mode & 0o777;
 
-  state.borrow::<Permissions>().write.check(&path)?;
+  state.borrow_mut::<Permissions>().write.check(&path)?;
   debug!("op_chmod_sync {} {:o}", path.display(), mode);
   #[cfg(unix)]
   {
@@ -513,8 +513,8 @@ async fn op_chmod_async(
   let mode = args.mode & 0o777;
 
   {
-    let state = state.borrow();
-    state.borrow::<Permissions>().write.check(&path)?;
+    let mut state = state.borrow_mut();
+    state.borrow_mut::<Permissions>().write.check(&path)?;
   }
 
   tokio::task::spawn_blocking(move || {
@@ -552,7 +552,7 @@ fn op_chown_sync(
   _zero_copy: Option<ZeroCopyBuf>,
 ) -> Result<(), AnyError> {
   let path = Path::new(&args.path).to_path_buf();
-  state.borrow::<Permissions>().write.check(&path)?;
+  state.borrow_mut::<Permissions>().write.check(&path)?;
   debug!(
     "op_chown_sync {} {:?} {:?}",
     path.display(),
@@ -582,8 +582,8 @@ async fn op_chown_async(
   let path = Path::new(&args.path).to_path_buf();
 
   {
-    let state = state.borrow();
-    state.borrow::<Permissions>().write.check(&path)?;
+    let mut state = state.borrow_mut();
+    state.borrow_mut::<Permissions>().write.check(&path)?;
   }
 
   tokio::task::spawn_blocking(move || {
@@ -624,7 +624,7 @@ fn op_remove_sync(
   let path = PathBuf::from(&args.path);
   let recursive = args.recursive;
 
-  state.borrow::<Permissions>().write.check(&path)?;
+  state.borrow_mut::<Permissions>().write.check(&path)?;
 
   #[cfg(not(unix))]
   use std::os::windows::prelude::MetadataExt;
@@ -667,8 +667,8 @@ async fn op_remove_async(
   let recursive = args.recursive;
 
   {
-    let state = state.borrow();
-    state.borrow::<Permissions>().write.check(&path)?;
+    let mut state = state.borrow_mut();
+    state.borrow_mut::<Permissions>().write.check(&path)?;
   }
 
   tokio::task::spawn_blocking(move || {
@@ -722,7 +722,7 @@ fn op_copy_file_sync(
   let from = PathBuf::from(&args.from);
   let to = PathBuf::from(&args.to);
 
-  let permissions = state.borrow::<Permissions>();
+  let permissions = state.borrow_mut::<Permissions>();
   permissions.read.check(&from)?;
   permissions.write.check(&to)?;
 
@@ -748,8 +748,8 @@ async fn op_copy_file_async(
   let to = PathBuf::from(&args.to);
 
   {
-    let state = state.borrow();
-    let permissions = state.borrow::<Permissions>();
+    let mut state = state.borrow_mut();
+    let permissions = state.borrow_mut::<Permissions>();
     permissions.read.check(&from)?;
     permissions.write.check(&to)?;
   }
@@ -861,7 +861,7 @@ fn op_stat_sync(
 ) -> Result<FsStat, AnyError> {
   let path = PathBuf::from(&args.path);
   let lstat = args.lstat;
-  state.borrow::<Permissions>().read.check(&path)?;
+  state.borrow_mut::<Permissions>().read.check(&path)?;
   debug!("op_stat_sync {} {}", path.display(), lstat);
   let metadata = if lstat {
     std::fs::symlink_metadata(&path)?
@@ -880,8 +880,8 @@ async fn op_stat_async(
   let lstat = args.lstat;
 
   {
-    let state = state.borrow();
-    state.borrow::<Permissions>().read.check(&path)?;
+    let mut state = state.borrow_mut();
+    state.borrow_mut::<Permissions>().read.check(&path)?;
   }
 
   tokio::task::spawn_blocking(move || {
@@ -904,7 +904,7 @@ fn op_realpath_sync(
 ) -> Result<String, AnyError> {
   let path = PathBuf::from(&path);
 
-  let permissions = state.borrow::<Permissions>();
+  let permissions = state.borrow_mut::<Permissions>();
   permissions.read.check(&path)?;
   if path.is_relative() {
     permissions.read.check_blind(&current_dir()?, "CWD")?;
@@ -926,8 +926,8 @@ async fn op_realpath_async(
   let path = PathBuf::from(&path);
 
   {
-    let state = state.borrow();
-    let permissions = state.borrow::<Permissions>();
+    let mut state = state.borrow_mut();
+    let permissions = state.borrow_mut::<Permissions>();
     permissions.read.check(&path)?;
     if path.is_relative() {
       permissions.read.check_blind(&current_dir()?, "CWD")?;
@@ -962,7 +962,7 @@ fn op_read_dir_sync(
 ) -> Result<Vec<DirEntry>, AnyError> {
   let path = PathBuf::from(&path);
 
-  state.borrow::<Permissions>().read.check(&path)?;
+  state.borrow_mut::<Permissions>().read.check(&path)?;
 
   debug!("op_read_dir_sync {}", path.display());
   let entries: Vec<_> = std::fs::read_dir(path)?
@@ -998,8 +998,8 @@ async fn op_read_dir_async(
 ) -> Result<Vec<DirEntry>, AnyError> {
   let path = PathBuf::from(&path);
   {
-    let state = state.borrow();
-    state.borrow::<Permissions>().read.check(&path)?;
+    let mut state = state.borrow_mut();
+    state.borrow_mut::<Permissions>().read.check(&path)?;
   }
   tokio::task::spawn_blocking(move || {
     debug!("op_read_dir_async {}", path.display());
@@ -1047,7 +1047,7 @@ fn op_rename_sync(
   let oldpath = PathBuf::from(&args.oldpath);
   let newpath = PathBuf::from(&args.newpath);
 
-  let permissions = state.borrow::<Permissions>();
+  let permissions = state.borrow_mut::<Permissions>();
   permissions.read.check(&oldpath)?;
   permissions.write.check(&oldpath)?;
   permissions.write.check(&newpath)?;
@@ -1064,8 +1064,8 @@ async fn op_rename_async(
   let oldpath = PathBuf::from(&args.oldpath);
   let newpath = PathBuf::from(&args.newpath);
   {
-    let state = state.borrow();
-    let permissions = state.borrow::<Permissions>();
+    let mut state = state.borrow_mut();
+    let permissions = state.borrow_mut::<Permissions>();
     permissions.read.check(&oldpath)?;
     permissions.write.check(&oldpath)?;
     permissions.write.check(&newpath)?;
@@ -1098,7 +1098,7 @@ fn op_link_sync(
   let oldpath = PathBuf::from(&args.oldpath);
   let newpath = PathBuf::from(&args.newpath);
 
-  let permissions = state.borrow::<Permissions>();
+  let permissions = state.borrow_mut::<Permissions>();
   permissions.read.check(&oldpath)?;
   permissions.write.check(&oldpath)?;
   permissions.read.check(&newpath)?;
@@ -1118,8 +1118,8 @@ async fn op_link_async(
   let newpath = PathBuf::from(&args.newpath);
 
   {
-    let state = state.borrow();
-    let permissions = state.borrow::<Permissions>();
+    let mut state = state.borrow_mut();
+    let permissions = state.borrow_mut::<Permissions>();
     permissions.read.check(&oldpath)?;
     permissions.write.check(&oldpath)?;
     permissions.read.check(&newpath)?;
@@ -1159,7 +1159,7 @@ fn op_symlink_sync(
   let oldpath = PathBuf::from(&args.oldpath);
   let newpath = PathBuf::from(&args.newpath);
 
-  state.borrow::<Permissions>().write.check(&newpath)?;
+  state.borrow_mut::<Permissions>().write.check(&newpath)?;
 
   debug!(
     "op_symlink_sync {} {}",
@@ -1209,8 +1209,8 @@ async fn op_symlink_async(
   let newpath = PathBuf::from(&args.newpath);
 
   {
-    let state = state.borrow();
-    state.borrow::<Permissions>().write.check(&newpath)?;
+    let mut state = state.borrow_mut();
+    state.borrow_mut::<Permissions>().write.check(&newpath)?;
   }
 
   tokio::task::spawn_blocking(move || {
@@ -1259,7 +1259,7 @@ fn op_read_link_sync(
 ) -> Result<String, AnyError> {
   let path = PathBuf::from(&path);
 
-  state.borrow::<Permissions>().read.check(&path)?;
+  state.borrow_mut::<Permissions>().read.check(&path)?;
 
   debug!("op_read_link_value {}", path.display());
   let target = std::fs::read_link(&path)?.into_os_string();
@@ -1274,8 +1274,8 @@ async fn op_read_link_async(
 ) -> Result<String, AnyError> {
   let path = PathBuf::from(&path);
   {
-    let state = state.borrow();
-    state.borrow::<Permissions>().read.check(&path)?;
+    let mut state = state.borrow_mut();
+    state.borrow_mut::<Permissions>().read.check(&path)?;
   }
   tokio::task::spawn_blocking(move || {
     debug!("op_read_link_async {}", path.display());
@@ -1349,7 +1349,7 @@ fn op_truncate_sync(
   let path = PathBuf::from(&args.path);
   let len = args.len;
 
-  state.borrow::<Permissions>().write.check(&path)?;
+  state.borrow_mut::<Permissions>().write.check(&path)?;
 
   debug!("op_truncate_sync {} {}", path.display(), len);
   let f = std::fs::OpenOptions::new().write(true).open(&path)?;
@@ -1365,8 +1365,8 @@ async fn op_truncate_async(
   let path = PathBuf::from(&args.path);
   let len = args.len;
   {
-    let state = state.borrow();
-    state.borrow::<Permissions>().write.check(&path)?;
+    let mut state = state.borrow_mut();
+    state.borrow_mut::<Permissions>().write.check(&path)?;
   }
   tokio::task::spawn_blocking(move || {
     debug!("op_truncate_async {} {}", path.display(), len);
@@ -1441,7 +1441,7 @@ fn op_make_temp_dir_sync(
   let suffix = args.suffix.map(String::from);
 
   state
-    .borrow::<Permissions>()
+    .borrow_mut::<Permissions>()
     .write
     .check(dir.clone().unwrap_or_else(temp_dir).as_path())?;
 
@@ -1469,9 +1469,9 @@ async fn op_make_temp_dir_async(
   let prefix = args.prefix.map(String::from);
   let suffix = args.suffix.map(String::from);
   {
-    let state = state.borrow();
+    let mut state = state.borrow_mut();
     state
-      .borrow::<Permissions>()
+      .borrow_mut::<Permissions>()
       .write
       .check(dir.clone().unwrap_or_else(temp_dir).as_path())?;
   }
@@ -1504,7 +1504,7 @@ fn op_make_temp_file_sync(
   let suffix = args.suffix.map(String::from);
 
   state
-    .borrow::<Permissions>()
+    .borrow_mut::<Permissions>()
     .write
     .check(dir.clone().unwrap_or_else(temp_dir).as_path())?;
 
@@ -1532,9 +1532,9 @@ async fn op_make_temp_file_async(
   let prefix = args.prefix.map(String::from);
   let suffix = args.suffix.map(String::from);
   {
-    let state = state.borrow();
+    let mut state = state.borrow_mut();
     state
-      .borrow::<Permissions>()
+      .borrow_mut::<Permissions>()
       .write
       .check(dir.clone().unwrap_or_else(temp_dir).as_path())?;
   }
@@ -1648,7 +1648,7 @@ fn op_utime_sync(
   let atime = filetime::FileTime::from_unix_time(args.atime.0, args.atime.1);
   let mtime = filetime::FileTime::from_unix_time(args.mtime.0, args.mtime.1);
 
-  state.borrow::<Permissions>().write.check(&path)?;
+  state.borrow_mut::<Permissions>().write.check(&path)?;
   filetime::set_file_times(path, atime, mtime)?;
   Ok(())
 }
@@ -1664,7 +1664,11 @@ async fn op_utime_async(
   let atime = filetime::FileTime::from_unix_time(args.atime.0, args.atime.1);
   let mtime = filetime::FileTime::from_unix_time(args.mtime.0, args.mtime.1);
 
-  state.borrow().borrow::<Permissions>().write.check(&path)?;
+  state
+    .borrow_mut()
+    .borrow_mut::<Permissions>()
+    .write
+    .check(&path)?;
 
   tokio::task::spawn_blocking(move || {
     filetime::set_file_times(path, atime, mtime)?;
@@ -1681,7 +1685,7 @@ fn op_cwd(
 ) -> Result<String, AnyError> {
   let path = current_dir()?;
   state
-    .borrow::<Permissions>()
+    .borrow_mut::<Permissions>()
     .read
     .check_blind(&path, "CWD")?;
   let path_str = into_string(path.into_os_string())?;
diff --git a/runtime/ops/fs_events.rs b/runtime/ops/fs_events.rs
index a64f31a33..30ab69ba5 100644
--- a/runtime/ops/fs_events.rs
+++ b/runtime/ops/fs_events.rs
@@ -109,7 +109,7 @@ fn op_fs_events_open(
   };
   for path in &args.paths {
     state
-      .borrow::<Permissions>()
+      .borrow_mut::<Permissions>()
       .read
       .check(&PathBuf::from(path))?;
     watcher.watch(path, recursive_mode)?;
diff --git a/runtime/ops/net.rs b/runtime/ops/net.rs
index 4c38d2293..934ff7926 100644
--- a/runtime/ops/net.rs
+++ b/runtime/ops/net.rs
@@ -224,8 +224,8 @@ async fn op_datagram_send(
       transport_args: ArgsEnum::Ip(args),
     } if transport == "udp" => {
       {
-        let s = state.borrow();
-        s.borrow::<Permissions>()
+        let mut s = state.borrow_mut();
+        s.borrow_mut::<Permissions>()
           .net
           .check(&(&args.hostname, Some(args.port)))?;
       }
@@ -251,8 +251,8 @@ async fn op_datagram_send(
     } if transport == "unixpacket" => {
       let address_path = Path::new(&args.path);
       {
-        let s = state.borrow();
-        s.borrow::<Permissions>().write.check(&address_path)?;
+        let mut s = state.borrow_mut();
+        s.borrow_mut::<Permissions>().write.check(&address_path)?;
       }
       let resource = state
         .borrow()
@@ -289,9 +289,9 @@ async fn op_connect(
       transport_args: ArgsEnum::Ip(args),
     } if transport == "tcp" => {
       {
-        let state_ = state.borrow();
+        let mut state_ = state.borrow_mut();
         state_
-          .borrow::<Permissions>()
+          .borrow_mut::<Permissions>()
           .net
           .check(&(&args.hostname, Some(args.port)))?;
       }
@@ -327,9 +327,15 @@ async fn op_connect(
       let address_path = Path::new(&args.path);
       super::check_unstable2(&state, "Deno.connect");
       {
-        let state_ = state.borrow();
-        state_.borrow::<Permissions>().read.check(&address_path)?;
-        state_.borrow::<Permissions>().write.check(&address_path)?;
+        let mut state_ = state.borrow_mut();
+        state_
+          .borrow_mut::<Permissions>()
+          .read
+          .check(&address_path)?;
+        state_
+          .borrow_mut::<Permissions>()
+          .write
+          .check(&address_path)?;
       }
       let path = args.path;
       let unix_stream = net_unix::UnixStream::connect(Path::new(&path)).await?;
@@ -443,7 +449,6 @@ fn op_listen(
   args: ListenArgs,
   _zero_copy: Option<ZeroCopyBuf>,
 ) -> Result<OpConn, AnyError> {
-  let permissions = state.borrow::<Permissions>();
   match args {
     ListenArgs {
       transport,
@@ -453,7 +458,10 @@ fn op_listen(
         if transport == "udp" {
           super::check_unstable(state, "Deno.listenDatagram");
         }
-        permissions.net.check(&(&args.hostname, Some(args.port)))?;
+        state
+          .borrow_mut::<Permissions>()
+          .net
+          .check(&(&args.hostname, Some(args.port)))?;
       }
       let addr = resolve_addr_sync(&args.hostname, args.port)?
         .next()
@@ -497,6 +505,7 @@ fn op_listen(
         if transport == "unixpacket" {
           super::check_unstable(state, "Deno.listenDatagram");
         }
+        let permissions = state.borrow_mut::<Permissions>();
         permissions.read.check(&address_path)?;
         permissions.write.check(&address_path)?;
       }
@@ -604,8 +613,8 @@ async fn op_dns_resolve(
   };
 
   {
-    let s = state.borrow();
-    let perm = s.borrow::<Permissions>();
+    let mut s = state.borrow_mut();
+    let perm = s.borrow_mut::<Permissions>();
 
     // Checks permission against the name servers which will be actually queried.
     for ns in config.name_servers() {
diff --git a/runtime/ops/os.rs b/runtime/ops/os.rs
index 5f265bf20..b13b54d22 100644
--- a/runtime/ops/os.rs
+++ b/runtime/ops/os.rs
@@ -32,7 +32,7 @@ fn op_exec_path(
 ) -> Result<String, AnyError> {
   let current_exe = env::current_exe().unwrap();
   state
-    .borrow::<Permissions>()
+    .borrow_mut::<Permissions>()
     .read
     .check_blind(&current_exe, "exec_path")?;
   // Now apply URL parser to current exe to get fully resolved path, otherwise
@@ -54,7 +54,7 @@ fn op_set_env(
   args: SetEnv,
   _zero_copy: Option<ZeroCopyBuf>,
 ) -> Result<(), AnyError> {
-  state.borrow::<Permissions>().env.check()?;
+  state.borrow_mut::<Permissions>().env.check()?;
   let invalid_key =
     args.key.is_empty() || args.key.contains(&['=', '\0'] as &[char]);
   let invalid_value = args.value.contains('\0');
@@ -70,7 +70,7 @@ fn op_env(
   _args: (),
   _zero_copy: Option<ZeroCopyBuf>,
 ) -> Result<HashMap<String, String>, AnyError> {
-  state.borrow::<Permissions>().env.check()?;
+  state.borrow_mut::<Permissions>().env.check()?;
   Ok(env::vars().collect())
 }
 
@@ -79,7 +79,7 @@ fn op_get_env(
   key: String,
   _zero_copy: Option<ZeroCopyBuf>,
 ) -> Result<Option<String>, AnyError> {
-  state.borrow::<Permissions>().env.check()?;
+  state.borrow_mut::<Permissions>().env.check()?;
   if key.is_empty() || key.contains(&['=', '\0'] as &[char]) {
     return Err(type_error("Key contains invalid characters."));
   }
@@ -94,7 +94,7 @@ fn op_delete_env(
   key: String,
   _zero_copy: Option<ZeroCopyBuf>,
 ) -> Result<(), AnyError> {
-  state.borrow::<Permissions>().env.check()?;
+  state.borrow_mut::<Permissions>().env.check()?;
   if key.is_empty() || key.contains(&['=', '\0'] as &[char]) {
     return Err(type_error("Key contains invalid characters."));
   }
@@ -116,7 +116,7 @@ fn op_loadavg(
   _zero_copy: Option<ZeroCopyBuf>,
 ) -> Result<(f64, f64, f64), AnyError> {
   super::check_unstable(state, "Deno.loadavg");
-  state.borrow::<Permissions>().env.check()?;
+  state.borrow_mut::<Permissions>().env.check()?;
   match sys_info::loadavg() {
     Ok(loadavg) => Ok((loadavg.one, loadavg.five, loadavg.fifteen)),
     Err(_) => Ok((0.0, 0.0, 0.0)),
@@ -129,7 +129,7 @@ fn op_hostname(
   _zero_copy: Option<ZeroCopyBuf>,
 ) -> Result<String, AnyError> {
   super::check_unstable(state, "Deno.hostname");
-  state.borrow::<Permissions>().env.check()?;
+  state.borrow_mut::<Permissions>().env.check()?;
   let hostname = sys_info::hostname().unwrap_or_else(|_| "".to_string());
   Ok(hostname)
 }
@@ -140,7 +140,7 @@ fn op_os_release(
   _zero_copy: Option<ZeroCopyBuf>,
 ) -> Result<String, AnyError> {
   super::check_unstable(state, "Deno.osRelease");
-  state.borrow::<Permissions>().env.check()?;
+  state.borrow_mut::<Permissions>().env.check()?;
   let release = sys_info::os_release().unwrap_or_else(|_| "".to_string());
   Ok(release)
 }
@@ -164,7 +164,7 @@ fn op_system_memory_info(
   _zero_copy: Option<ZeroCopyBuf>,
 ) -> Result<Option<MemInfo>, AnyError> {
   super::check_unstable(state, "Deno.systemMemoryInfo");
-  state.borrow::<Permissions>().env.check()?;
+  state.borrow_mut::<Permissions>().env.check()?;
   match sys_info::mem_info() {
     Ok(info) => Ok(Some(MemInfo {
       total: info.total,
@@ -191,7 +191,7 @@ fn op_system_cpu_info(
   _zero_copy: Option<ZeroCopyBuf>,
 ) -> Result<CpuInfo, AnyError> {
   super::check_unstable(state, "Deno.systemCpuInfo");
-  state.borrow::<Permissions>().env.check()?;
+  state.borrow_mut::<Permissions>().env.check()?;
 
   let cores = sys_info::cpu_num().ok();
   let speed = sys_info::cpu_speed().ok();
diff --git a/runtime/ops/plugin.rs b/runtime/ops/plugin.rs
index 0397dbca3..d0fc989f4 100644
--- a/runtime/ops/plugin.rs
+++ b/runtime/ops/plugin.rs
@@ -34,7 +34,7 @@ pub fn op_open_plugin(
   let filename = PathBuf::from(&filename);
 
   super::check_unstable(state, "Deno.openPlugin");
-  let permissions = state.borrow::<Permissions>();
+  let permissions = state.borrow_mut::<Permissions>();
   permissions.plugin.check()?;
 
   debug!("Loading Plugin: {:#?}", filename);
diff --git a/runtime/ops/process.rs b/runtime/ops/process.rs
index 625bc204c..4b49e21f3 100644
--- a/runtime/ops/process.rs
+++ b/runtime/ops/process.rs
@@ -97,7 +97,7 @@ fn op_run(
   _zero_copy: Option<ZeroCopyBuf>,
 ) -> Result<RunInfo, AnyError> {
   let args = run_args.cmd;
-  state.borrow::<Permissions>().run.check(&args[0])?;
+  state.borrow_mut::<Permissions>().run.check(&args[0])?;
   let env = run_args.env;
   let cwd = run_args.cwd;
 
@@ -286,7 +286,7 @@ fn op_kill(
   _zero_copy: Option<ZeroCopyBuf>,
 ) -> Result<(), AnyError> {
   super::check_unstable(state, "Deno.kill");
-  state.borrow::<Permissions>().run.check_all()?;
+  state.borrow_mut::<Permissions>().run.check_all()?;
 
   kill(args.pid, args.signo)?;
   Ok(())
diff --git a/runtime/ops/runtime.rs b/runtime/ops/runtime.rs
index ef7445b11..d694cb9c9 100644
--- a/runtime/ops/runtime.rs
+++ b/runtime/ops/runtime.rs
@@ -31,7 +31,7 @@ fn op_main_module(
   if main_url.scheme() == "file" {
     let main_path = std::env::current_dir().unwrap().join(main_url.to_string());
     state
-      .borrow::<Permissions>()
+      .borrow_mut::<Permissions>()
       .read
       .check_blind(&main_path, "main_module")?;
   }
diff --git a/runtime/ops/timers.rs b/runtime/ops/timers.rs
index 428d4ecea..aee38cf8d 100644
--- a/runtime/ops/timers.rs
+++ b/runtime/ops/timers.rs
@@ -140,7 +140,7 @@ fn op_now(
   // If the permission is not enabled
   // Round the nano result on 2 milliseconds
   // see: https://developer.mozilla.org/en-US/docs/Web/API/DOMHighResTimeStamp#Reduced_time_precision
-  if op_state.borrow::<Permissions>().hrtime.check().is_err() {
+  if op_state.borrow_mut::<Permissions>().hrtime.check().is_err() {
     subsec_nanos -= subsec_nanos % reduced_time_precision;
   }
 
diff --git a/runtime/ops/tls.rs b/runtime/ops/tls.rs
index 83dbbfcd1..36762d66c 100644
--- a/runtime/ops/tls.rs
+++ b/runtime/ops/tls.rs
@@ -107,8 +107,8 @@ async fn op_start_tls(
   }
   {
     super::check_unstable2(&state, "Deno.startTls");
-    let s = state.borrow();
-    let permissions = s.borrow::<Permissions>();
+    let mut s = state.borrow_mut();
+    let permissions = s.borrow_mut::<Permissions>();
     permissions.net.check(&(&domain, Some(0)))?;
     if let Some(path) = &args.cert_file {
       permissions.read.check(Path::new(&path))?;
@@ -170,8 +170,8 @@ async fn op_connect_tls(
   assert_eq!(args.transport, "tcp");
 
   {
-    let s = state.borrow();
-    let permissions = s.borrow::<Permissions>();
+    let mut s = state.borrow_mut();
+    let permissions = s.borrow_mut::<Permissions>();
     permissions.net.check(&(&args.hostname, Some(args.port)))?;
     if let Some(path) = &args.cert_file {
       permissions.read.check(Path::new(&path))?;
@@ -313,7 +313,7 @@ fn op_listen_tls(
   let cert_file = args.cert_file;
   let key_file = args.key_file;
   {
-    let permissions = state.borrow::<Permissions>();
+    let permissions = state.borrow_mut::<Permissions>();
     permissions.net.check(&(&args.hostname, Some(args.port)))?;
     permissions.read.check(Path::new(&cert_file))?;
     permissions.read.check(Path::new(&key_file))?;