Deno allow-read doesn't work for / (root directory) if a deny-read parameter is set.

[matheusgr]

Version: Deno 2.1.5 (also tested on 1.44.4, 1.46.4, 2.1.2)
OS: MacOS 15.2 (also tested on linux)

When allow-read is used in combination with deny-read, it doesn't allow access to the root directory.

Test file

import * as fs from "node:fs";

console.log(fs.statSync("/tmp").mtime);
console.log(fs.statSync("/").mtime);

Expected output

$ deno run --allow-read access.ts

2025-01-10T03:19:51.822Z
2024-12-07T08:11:55.000Z

Output with bug

$ deno run --allow-read --deny-read=/mnt access.ts

2025-01-10T03:19:51.822Z
error: Uncaught (in promise) NotCapable: Requires read access to "/", run again with the --allow-read flag
console.log(fs.statSync("/").mtime);
               ^
    at Object.statSync (ext:deno_fs/30_fs.js:415:3)
    at Module.statSync (ext:deno_node/_fs/_fs_stat.ts:163:25)
    at file:///Users/matheusgr/access.ts:4:16

Setting allow-read to root directory also fails.

---

We caught this issue due to the last browserslist update (4.24.4) . It may stat the root directory and fail due to some deny-read configuration that we use.

[matheusgr]

Also reproducible with deno FS API:

deno_access.ts

using file = Deno.openSync("/")
const fileInfo = file.statSync();
console.log(fileInfo.isDirectory);

$ deno run --allow-read --deny-read=/tmp deno_access.ts

error: Uncaught (in promise) NotCapable: Requires read access to "/", run again with the --allow-read flag
using file = Deno.openSync("/")
                  ^
    at Object.openSync (ext:deno_fs/30_fs.js:528:15)
    at file:///Users/matheusgr/deno_access.ts:2:19