Merge "Check permission of package, not caller." into nyc-dev