diff --git a/cli/ops.rs b/cli/ops.rs
index d5da9056784d1..166610bac791d 100644
--- a/cli/ops.rs
+++ b/cli/ops.rs
@@ -1404,10 +1404,13 @@ fn op_rename(
 ) -> CliOpResult {
   assert!(data.is_none());
   let inner = base.inner_as_rename().unwrap();
-  let (oldpath, _) = deno_fs::resolve_from_cwd(inner.oldpath().unwrap())?;
+  let (oldpath, oldpath_) =
+    deno_fs::resolve_from_cwd(inner.oldpath().unwrap())?;
   let (newpath, newpath_) =
     deno_fs::resolve_from_cwd(inner.newpath().unwrap())?;
 
+  state.check_read(&oldpath_)?;
+  state.check_write(&oldpath_)?;
   state.check_write(&newpath_)?;
 
   blocking(base.sync(), move || {
@@ -1424,10 +1427,12 @@ fn op_link(
 ) -> CliOpResult {
   assert!(data.is_none());
   let inner = base.inner_as_link().unwrap();
-  let (oldname, _) = deno_fs::resolve_from_cwd(inner.oldname().unwrap())?;
+  let (oldname, oldpath_) =
+    deno_fs::resolve_from_cwd(inner.oldname().unwrap())?;
   let (newname, newname_) =
     deno_fs::resolve_from_cwd(inner.newname().unwrap())?;
 
+  state.check_read(&oldpath_)?;
   state.check_write(&newname_)?;
 
   blocking(base.sync(), move || {
diff --git a/js/link_test.ts b/js/link_test.ts
index 86e466abfc406..9425e6eabd220 100644
--- a/js/link_test.ts
+++ b/js/link_test.ts
@@ -1,5 +1,5 @@
 // Copyright 2018-2019 the Deno authors. All rights reserved. MIT license.
-import { test, testPerm, assert, assertEquals } from "./test_util.ts";
+import { testPerm, assert, assertEquals } from "./test_util.ts";
 
 testPerm({ read: true, write: true }, function linkSyncSuccess(): void {
   const testDir = Deno.makeTempDirSync();
@@ -63,7 +63,18 @@ testPerm({ read: true, write: true }, function linkSyncNotFound(): void {
   assertEquals(err.name, "NotFound");
 });
 
-test(function linkSyncPerm(): void {
+testPerm({ read: false, write: true }, function linkSyncReadPerm(): void {
+  let err;
+  try {
+    Deno.linkSync("oldbaddir", "newbaddir");
+  } catch (e) {
+    err = e;
+  }
+  assertEquals(err.kind, Deno.ErrorKind.PermissionDenied);
+  assertEquals(err.name, "PermissionDenied");
+});
+
+testPerm({ read: true, write: false }, function linkSyncWritePerm(): void {
   let err;
   try {
     Deno.linkSync("oldbaddir", "newbaddir");
diff --git a/js/rename_test.ts b/js/rename_test.ts
index ce87a3dfe4fca..43d02d419f678 100644
--- a/js/rename_test.ts
+++ b/js/rename_test.ts
@@ -23,7 +23,20 @@ testPerm({ read: true, write: true }, function renameSyncSuccess(): void {
   assertEquals(oldPathInfo, undefined);
 });
 
-testPerm({ read: true, write: false }, function renameSyncPerm(): void {
+testPerm({ read: false, write: true }, function renameSyncReadPerm(): void {
+  let err;
+  try {
+    const oldpath = "/oldbaddir";
+    const newpath = "/newbaddir";
+    Deno.renameSync(oldpath, newpath);
+  } catch (e) {
+    err = e;
+  }
+  assertEquals(err.kind, Deno.ErrorKind.PermissionDenied);
+  assertEquals(err.name, "PermissionDenied");
+});
+
+testPerm({ read: true, write: false }, function renameSyncWritePerm(): void {
   let err;
   try {
     const oldpath = "/oldbaddir";