diff --git a/kernel-src/fs/vfs.c b/kernel-src/fs/vfs.c
index 032c05be..0e87567f 100644
--- a/kernel-src/fs/vfs.c
+++ b/kernel-src/fs/vfs.c
@@ -523,6 +523,10 @@ int vfs_lookup(vnode_t **result, vnode_t *start, char *path, char *lastcomp, int
 			}
 		}
 
+		error = VOP_ACCESS(current, V_ACCESS_SEARCH, getcred());
+		if (error)
+			break;
+
 		error = VOP_LOOKUP(current, component, &next, getcred());
 		if (error)
 			break;
diff --git a/kernel-src/include/kernel/vfs.h b/kernel-src/include/kernel/vfs.h
index 52ad30d9..8f11eb96 100644
--- a/kernel-src/include/kernel/vfs.h
+++ b/kernel-src/include/kernel/vfs.h
@@ -38,6 +38,7 @@
 #define V_ATTR_MODE_SGID 		02000
 #define V_ATTR_MODE_SUID 		04000
 
+#define V_ACCESS_SEARCH 1
 #define V_ACCESS_EXECUTE 1
 #define V_ACCESS_WRITE 2
 #define V_ACCESS_READ 4
diff --git a/kernel-src/sys/defaultauth.c b/kernel-src/sys/defaultauth.c
index 4526388f..41c1847b 100644
--- a/kernel-src/sys/defaultauth.c
+++ b/kernel-src/sys/defaultauth.c
@@ -46,7 +46,9 @@ static int filesystem(cred_t *cred, int actions, void *arg0, void *arg1, void *a
 	}
 
 	if (actions & AUTH_ACTIONS_FILESYSTEM_EXECUTE) {
-		if ((attr.mode & (V_ATTR_MODE_USER_EXECUTE | V_ATTR_MODE_GROUP_EXECUTE | V_ATTR_MODE_OTHERS_EXECUTE)) && CRED_IS_ESU(cred))
+		if (vnode->type == V_TYPE_DIR && CRED_IS_ESU(cred))
+			weight += 1;
+		else if ((attr.mode & (V_ATTR_MODE_USER_EXECUTE | V_ATTR_MODE_GROUP_EXECUTE | V_ATTR_MODE_OTHERS_EXECUTE)) && CRED_IS_ESU(cred))
 			weight += 1;
 		else if (attr.uid == cred->euid && (attr.mode & V_ATTR_MODE_USER_EXECUTE))
 			weight += 1;