4 files changed, 29 insertions, 5 deletions
diff --git a/cli/js/lib.deno.ns.d.ts b/cli/js/lib.deno.ns.d.ts
index a05ff9fd6..83dc362ea 100644
--- a/cli/js/lib.deno.ns.d.ts
+++ b/cli/js/lib.deno.ns.d.ts
@@ -147,7 +147,7 @@ declare namespace Deno {
    *
    *       console.log(Deno.execPath());  // e.g. "/home/alice/.local/bin/deno"
    *
-   * Requires `allow-env` permission.
+   * Requires `allow-read` permission.
    */
   export function execPath(): string;
 
diff --git a/cli/js/tests/os_test.ts b/cli/js/tests/os_test.ts
index a44b69e7d..e99002534 100644
--- a/cli/js/tests/os_test.ts
+++ b/cli/js/tests/os_test.ts
@@ -48,7 +48,10 @@ unitTest(function envPermissionDenied2(): void {
 // case-insensitive. Case normalization needs be done using the collation
 // that Windows uses, rather than naively using String.toLowerCase().
 unitTest(
-  { ignore: Deno.build.os !== "windows", perms: { env: true, run: true } },
+  {
+    ignore: Deno.build.os !== "windows",
+    perms: { read: true, env: true, run: true },
+  },
   async function envCaseInsensitive() {
     // Utility function that runs a Deno subprocess with the environment
     // specified in `inputEnv`. The subprocess reads the environment variables
@@ -269,11 +272,11 @@ unitTest(function getDirWithoutPermission(): void {
   );
 });
 
-unitTest({ perms: { env: true } }, function execPath(): void {
+unitTest({ perms: { read: true } }, function execPath(): void {
   assertNotEquals(Deno.execPath(), "");
 });
 
-unitTest({ perms: { env: false } }, function execPathPerm(): void {
+unitTest({ perms: { read: false } }, function execPathPerm(): void {
   let caughtError = false;
   try {
     Deno.execPath();
diff --git a/cli/ops/os.rs b/cli/ops/os.rs
index 5c205f37b..d9a6b3095 100644
--- a/cli/ops/os.rs
+++ b/cli/ops/os.rs
@@ -82,8 +82,8 @@ fn op_exec_path(
   _args: Value,
   _zero_copy: Option<ZeroCopyBuf>,
 ) -> Result<JsonOp, OpError> {
-  state.check_env()?;
   let current_exe = env::current_exe().unwrap();
+  state.check_read(&current_exe)?;
   // Now apply URL parser to current exe to get fully resolved path, otherwise
   // we might get `./` and `../` bits in `exec_path`
   let exe_url = Url::from_file_path(current_exe).unwrap();
diff --git a/cli/tests/integration_tests.rs b/cli/tests/integration_tests.rs
index dec3fe8ee..9a35ba300 100644
--- a/cli/tests/integration_tests.rs
+++ b/cli/tests/integration_tests.rs
@@ -2421,6 +2421,27 @@ async fn inspector_does_not_hang() {
   assert!(child.wait().unwrap().success());
 }
 
+#[test]
+fn exec_path() {
+  let output = util::deno_cmd()
+    .current_dir(util::root_path())
+    .arg("run")
+    .arg("--allow-read")
+    .arg("cli/tests/exec_path.ts")
+    .stdout(std::process::Stdio::piped())
+    .spawn()
+    .unwrap()
+    .wait_with_output()
+    .unwrap();
+  assert!(output.status.success());
+  let stdout_str = std::str::from_utf8(&output.stdout).unwrap().trim();
+  let actual =
+    std::fs::canonicalize(&std::path::Path::new(stdout_str)).unwrap();
+  let expected =
+    std::fs::canonicalize(deno::test_util::deno_exe_path()).unwrap();
+  assert_eq!(expected, actual);
+}
+
 mod util {
   use deno::colors::strip_ansi_codes;
   pub use deno::test_util::*;