fix execute checking in permission()