diff --git a/core/modules/aggregator/aggregator.pages.inc b/core/modules/aggregator/aggregator.pages.inc
index a711c18..03a4a4d 100644
--- a/core/modules/aggregator/aggregator.pages.inc
+++ b/core/modules/aggregator/aggregator.pages.inc
@@ -242,7 +242,7 @@ function template_preprocess_aggregator_feed_source(&$variables) {
     $variables['last_checked'] = t('never');
   }
 
-  if (user_access('administer news feeds')) {
+  if (\Drupal::currentUser()->hasPermission('administer news feeds')) {
     $variables['last_checked'] = l($variables['last_checked'], 'admin/config/services/aggregator');
   }
 
diff --git a/core/modules/aggregator/lib/Drupal/aggregator/Access/CategoriesAccessCheck.php b/core/modules/aggregator/lib/Drupal/aggregator/Access/CategoriesAccessCheck.php
index 32a0aa1..6bba8c8 100644
--- a/core/modules/aggregator/lib/Drupal/aggregator/Access/CategoriesAccessCheck.php
+++ b/core/modules/aggregator/lib/Drupal/aggregator/Access/CategoriesAccessCheck.php
@@ -11,6 +11,7 @@
 use Drupal\Core\Database\Connection;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\Routing\Route;
+use Drupal\Core\Session\AccountInterface;
 
 /**
  * Provides an access check for aggregator categories routes.
@@ -44,10 +45,9 @@ public function appliesTo() {
   /**
    * {@inheritdoc}
    */
-  public function access(Route $route, Request $request) {
-    // @todo Replace user_access() with a correctly injected and session-using
-    // alternative.
-    return user_access('access news feeds') && (bool) $this->database->queryRange('SELECT 1 FROM {aggregator_category}', 0, 1)->fetchField() ? static::ALLOW : static::DENY;
+  public function access(Route $route, Request $request, AccountInterface $account = NULL) {
+    $account = is_null($account) ? \Drupal::currentUser() : $account;
+    return $account->hasPermission('access news feeds') && (bool) $this->database->queryRange('SELECT 1 FROM {aggregator_category}', 0, 1)->fetchField() ? static::ALLOW : static::DENY;
   }
 
 }
diff --git a/core/modules/aggregator/lib/Drupal/aggregator/Plugin/Block/AggregatorCategoryBlock.php b/core/modules/aggregator/lib/Drupal/aggregator/Plugin/Block/AggregatorCategoryBlock.php
index eccd463..a2cc95e 100644
--- a/core/modules/aggregator/lib/Drupal/aggregator/Plugin/Block/AggregatorCategoryBlock.php
+++ b/core/modules/aggregator/lib/Drupal/aggregator/Plugin/Block/AggregatorCategoryBlock.php
@@ -13,6 +13,7 @@
 use Drupal\Core\Annotation\Translation;
 use Drupal\Core\Database\Connection;
 use Drupal\Core\Plugin\ContainerFactoryPluginInterface;
+use Drupal\Core\Session\AccountInterface;
 use Symfony\Component\DependencyInjection\ContainerInterface;
 
 /**
@@ -40,6 +41,13 @@ class AggregatorCategoryBlock extends BlockBase implements ContainerFactoryPlugi
   protected $categoryStorageController;
 
   /**
+   * The Drupal account to use for checking for access to block.
+   *
+   * @var \Drupal\Core\Session\AccountInterface
+   */
+  protected $account;
+
+  /**
    * Constructs an AggregatorFeedBlock object.
    *
    * @param array $configuration
@@ -50,11 +58,14 @@ class AggregatorCategoryBlock extends BlockBase implements ContainerFactoryPlugi
    *   The plugin implementation definition.
    * @param \Drupal\Core\Database\Connection $connection
    *   The database connection.
+   * @param \Drupal\Core\Session\AccountInterface $account
+   *   The $account object to use for checking for access to block.
    */
-  public function __construct(array $configuration, $plugin_id, array $plugin_definition, Connection $connection, CategoryStorageControllerInterface $category_storage_controller) {
+  public function __construct(array $configuration, $plugin_id, array $plugin_definition, Connection $connection, CategoryStorageControllerInterface $category_storage_controller, AccountInterface $account = NULL) {
     parent::__construct($configuration, $plugin_id, $plugin_definition);
     $this->connection = $connection;
     $this->categoryStorageController = $category_storage_controller;
+    $this->account = $account;
   }
 
 
@@ -67,7 +78,8 @@ public static function create(ContainerInterface $container, array $configuratio
       $plugin_id,
       $plugin_definition,
       $container->get('database'),
-      $container->get('aggregator.category.storage')
+      $container->get('aggregator.category.storage'),
+      $container->get('current_user')
     );
   }
 
@@ -87,7 +99,7 @@ public function defaultConfiguration() {
    */
   public function access() {
     // Only grant access to users with the 'access news feeds' permission.
-    return user_access('access news feeds');
+    return !empty($this->account) && $this->account->hasPermission('access news feeds');
   }
 
   /**
diff --git a/core/modules/aggregator/lib/Drupal/aggregator/Plugin/Block/AggregatorFeedBlock.php b/core/modules/aggregator/lib/Drupal/aggregator/Plugin/Block/AggregatorFeedBlock.php
index e0c2662..fc1c12a 100644
--- a/core/modules/aggregator/lib/Drupal/aggregator/Plugin/Block/AggregatorFeedBlock.php
+++ b/core/modules/aggregator/lib/Drupal/aggregator/Plugin/Block/AggregatorFeedBlock.php
@@ -13,6 +13,7 @@
 use Drupal\Core\Database\Connection;
 use Drupal\Core\Entity\EntityStorageControllerInterface;
 use Drupal\Core\Plugin\ContainerFactoryPluginInterface;
+use Drupal\Core\Session\AccountInterface;
 use Symfony\Component\DependencyInjection\ContainerInterface;
 
 /**
@@ -40,6 +41,13 @@ class AggregatorFeedBlock extends BlockBase implements ContainerFactoryPluginInt
   protected $connection;
 
   /**
+   * The Drupal account to use for checking for access to block.
+   *
+   * @var \Drupal\Core\Session\AccountInterface
+   */
+  protected $account;
+
+  /**
    * Constructs an AggregatorFeedBlock object.
    *
    * @param array $configuration
@@ -52,11 +60,14 @@ class AggregatorFeedBlock extends BlockBase implements ContainerFactoryPluginInt
    *   The entity storage controller for feeds.
    * @param \Drupal\Core\Database\Connection $connection
    *   The database connection.
+   * @param \Drupal\Core\Session\AccountInterface $account
+   *   The $account object to use for checking for access to block.
    */
-  public function __construct(array $configuration, $plugin_id, array $plugin_definition, EntityStorageControllerInterface $storage_controller, Connection $connection) {
+  public function __construct(array $configuration, $plugin_id, array $plugin_definition, EntityStorageControllerInterface $storage_controller, Connection $connection, AccountInterface $account = NULL) {
     parent::__construct($configuration, $plugin_id, $plugin_definition);
     $this->storageController = $storage_controller;
     $this->connection = $connection;
+    $this->account = $account;
   }
 
 
@@ -69,7 +80,8 @@ public static function create(ContainerInterface $container, array $configuratio
       $plugin_id,
       $plugin_definition,
       $container->get('plugin.manager.entity')->getStorageController('aggregator_feed'),
-      $container->get('database')
+      $container->get('database'),
+      $container->get('current_user')
     );
   }
 
@@ -90,7 +102,7 @@ public function defaultConfiguration() {
    */
   public function access() {
     // Only grant access to users with the 'access news feeds' permission.
-    return user_access('access news feeds');
+    return !empty($this->account) && $this->account->hasPermission('access news feeds');
   }
 
   /**