diff --git a/modules/tracker/tracker.module b/modules/tracker/tracker.module
index 227cf72..f505c0e 100644
--- a/modules/tracker/tracker.module
+++ b/modules/tracker/tracker.module
@@ -27,6 +27,16 @@ function tracker_help($path, $arg) {
 }
 
 /**
+ * Implements hook_permission().
+ */
+function tracker_permission() {
+  return array(
+    'access tracker' => array('title' => t('Access tracker')),
+    'access own tracker' => array('title' => t('Access own tracker')),
+  );
+}
+
+/**
  * Implements hook_menu().
  */
 function tracker_menu() {
@@ -152,14 +162,17 @@ function tracker_cron() {
  */
 function _tracker_myrecent_access($account) {
   // This path is only allowed for authenticated users looking at their own content.
-  return $account->uid && ($GLOBALS['user']->uid == $account->uid) && user_access('access content');
+  return ($account->uid && ($GLOBALS['user']->uid == $account->uid) && user_access('access content') && user_access('access own tracker')) ||
+    (user_access('access content') && user_access('access tracker'));
 }
 
 /**
  * Access callback for user/%user/track.
  */
 function _tracker_user_access($account) {
-  return user_view_access($account) && user_access('access content');
+  return user_view_access($account) && user_access('access content') &&
+  (($account->uid && ($GLOBALS['user']->uid != $account->uid) && user_access('access tracker')) ||
+   ($account->uid && ($GLOBALS['user']->uid == $account->uid) && user_access('access own tracker')));
 }
 
 /**
diff --git a/modules/tracker/tracker.test b/modules/tracker/tracker.test
index 3cc227e..6034a0a 100644
--- a/modules/tracker/tracker.test
+++ b/modules/tracker/tracker.test
@@ -6,8 +6,6 @@
  */
 
 class TrackerTest extends DrupalWebTestCase {
-  protected $user;
-  protected $other_user;
   protected $new_node;
 
   public static function getInfo() {
@@ -21,10 +19,6 @@ class TrackerTest extends DrupalWebTestCase {
   function setUp() {
     parent::setUp('comment', 'tracker');
 
-    $permissions = array('access comments', 'create page content', 'post comments', 'skip comment approval');
-    $this->user = $this->drupalCreateUser($permissions);
-    $this->other_user = $this->drupalCreateUser($permissions);
-
     // Make node preview optional.
     variable_set('comment_preview_page', 0);
   }
@@ -33,7 +27,9 @@ class TrackerTest extends DrupalWebTestCase {
    * Test the presence of nodes on the global tracker listing.
    */
   function testTrackerAll() {
-    $this->drupalLogin($this->user);
+    $permissions = array('access comments', 'create page content', 'post comments', 'skip comment approval', 'access tracker');
+    $user = $this->drupalCreateUser($permissions);
+    $this->drupalLogin($user);
 
     $unpublished = $this->drupalCreateNode(array(
       'title' =>$this->randomName(8),
@@ -59,26 +55,31 @@ class TrackerTest extends DrupalWebTestCase {
    * Test the presence of nodes on a user's tracker listing.
    */
   function testTrackerUser() {
-    $this->drupalLogin($this->user);
+    $permissions = array('access comments', 'create page content', 'post comments', 'skip comment approval', 'access own tracker');
+    $user = $this->drupalCreateUser($permissions);
+    $this->drupalLogin($user);
+
+    $permissions = array('access comments', 'create page content', 'post comments', 'skip comment approval', 'access tracker', 'access own tracker');
+    $other_user = $this->drupalCreateUser($permissions);
 
     $unpublished = $this->drupalCreateNode(array(
       'title' => $this->randomName(8),
-      'uid' => $this->user->uid,
+      'uid' => $user->uid,
       'status' => 0,
     ));
     $my_published = $this->drupalCreateNode(array(
       'title' => $this->randomName(8),
-      'uid' => $this->user->uid,
+      'uid' => $user->uid,
       'status' => 1,
     ));
     $other_published_no_comment = $this->drupalCreateNode(array(
       'title' => $this->randomName(8),
-      'uid' => $this->other_user->uid,
+      'uid' => $other_user->uid,
       'status' => 1,
     ));
     $other_published_my_comment = $this->drupalCreateNode(array(
       'title' => $this->randomName(8),
-      'uid' => $this->other_user->uid,
+      'uid' => $other_user->uid,
       'status' => 1,
     ));
     $comment = array(
@@ -87,17 +88,17 @@ class TrackerTest extends DrupalWebTestCase {
     );
     $this->drupalPost('comment/reply/' . $other_published_my_comment->nid, $comment, t('Save'));
 
-    $this->drupalGet('user/' . $this->user->uid . '/track');
+    $this->drupalGet('user/' . $user->uid . '/track');
     $this->assertNoText($unpublished->title, t("Unpublished nodes do not show up in the users's tracker listing."));
     $this->assertText($my_published->title, t("Published nodes show up in the user's tracker listing."));
     $this->assertNoText($other_published_no_comment->title, t("Other user's nodes do not show up in the user's tracker listing."));
     $this->assertText($other_published_my_comment->title, t("Nodes that the user has commented on appear in the user's tracker listing."));
 
     // Verify that unpublished comments are removed from the tracker.
-    $admin_user = $this->drupalCreateUser(array('administer comments', 'access user profiles'));
+    $admin_user = $this->drupalCreateUser(array('administer comments', 'access user profiles', 'access tracker'));
     $this->drupalLogin($admin_user);
     $this->drupalPost('comment/1/edit', array('status' => COMMENT_NOT_PUBLISHED), t('Save'));
-    $this->drupalGet('user/' . $this->user->uid . '/track');
+    $this->drupalGet('user/' . $user->uid . '/track');
     $this->assertNoText($other_published_my_comment->title, 'Unpublished comments are not counted on the tracker listing.');
   }
 
@@ -105,7 +106,12 @@ class TrackerTest extends DrupalWebTestCase {
    * Test the presence of the "new" flag for nodes.
    */
   function testTrackerNewNodes() {
-    $this->drupalLogin($this->user);
+    $permissions = array('access comments', 'create page content', 'post comments', 'skip comment approval', 'access tracker');
+    $user = $this->drupalCreateUser($permissions);
+    $this->drupalLogin($user);
+
+    $permissions = array('access comments', 'create page content', 'post comments', 'skip comment approval', 'access tracker');
+    $other_user = $this->drupalCreateUser($permissions);
 
     $edit = array(
       'title' => $this->randomName(8),
@@ -120,7 +126,7 @@ class TrackerTest extends DrupalWebTestCase {
     $this->drupalGet('tracker');
     $this->assertNoPattern('/' . $title . '.*new/', t('Visited nodes are not flagged as new.'));
 
-    $this->drupalLogin($this->other_user);
+    $this->drupalLogin($other_user);
     $this->drupalGet('tracker');
     $this->assertPattern('/' . $title . '.*new/', t('For another user, new nodes are flagged as such in the tracker listing.'));
 
@@ -133,7 +139,12 @@ class TrackerTest extends DrupalWebTestCase {
    * Test comment counters on the tracker listing.
    */
   function testTrackerNewComments() {
-    $this->drupalLogin($this->user);
+    $permissions = array('access comments', 'create page content', 'post comments', 'skip comment approval', 'access tracker');
+    $user = $this->drupalCreateUser($permissions);
+    $this->drupalLogin($user);
+
+    $permissions = array('access comments', 'create page content', 'post comments', 'skip comment approval', 'access tracker');
+    $other_user = $this->drupalCreateUser($permissions);
 
     $node = $this->drupalCreateNode(array(
       'comment' => 2,
@@ -147,7 +158,7 @@ class TrackerTest extends DrupalWebTestCase {
     );
     $this->drupalPost('comment/reply/' . $node->nid, $comment, t('Save')); // The new comment is automatically viewed by the current user.
 
-    $this->drupalLogin($this->other_user);
+    $this->drupalLogin($other_user);
     $this->drupalGet('tracker');
     $this->assertText('1 new', t('New comments are counted on the tracker listing pages.'));
     $this->drupalGet('node/' . $node->nid);
@@ -162,7 +173,7 @@ class TrackerTest extends DrupalWebTestCase {
     sleep(1);
     $this->drupalPost('comment/reply/' . $node->nid, $comment, t('Save'));
 
-    $this->drupalLogin($this->user);
+    $this->drupalLogin($user);
     $this->drupalGet('tracker');
     $this->assertText('1 new', t('New comments are counted on the tracker listing pages.'));
   }
@@ -171,7 +182,12 @@ class TrackerTest extends DrupalWebTestCase {
    * Test that existing nodes are indexed by cron.
    */
   function testTrackerCronIndexing() {
-    $this->drupalLogin($this->user);
+    $permissions = array('access comments', 'create page content', 'post comments', 'skip comment approval', 'access own tracker', 'access tracker');
+    $user = $this->drupalCreateUser($permissions);
+    $this->drupalLogin($user);
+
+    $permissions = array('access comments', 'create page content', 'post comments', 'skip comment approval', 'access tracker');
+    $other_user = $this->drupalCreateUser($permissions);
 
     // Create 3 nodes.
     $edits = array();
@@ -185,7 +201,7 @@ class TrackerTest extends DrupalWebTestCase {
     }
 
     // Add a comment to the last node as other user.
-    $this->drupalLogin($this->other_user);
+    $this->drupalLogin($other_user);
     $comment = array(
       'subject' => $this->randomName(),
       'comment_body[' . LANGUAGE_NONE . '][0][value]' => $this->randomName(20),
@@ -202,10 +218,10 @@ class TrackerTest extends DrupalWebTestCase {
       ->execute();
     tracker_cron();
 
-    $this->drupalLogin($this->user);
+    $this->drupalLogin($user);
 
     // Fetch the user's tracker.
-    $this->drupalGet('tracker/' . $this->user->uid);
+    $this->drupalGet('tracker/' . $user->uid);
 
     // Assert that all node titles are displayed.
     foreach ($nodes as $i => $node) {
@@ -229,7 +245,7 @@ class TrackerTest extends DrupalWebTestCase {
    * Test that publish/unpublish works at admin/content/node
    */
   function testTrackerAdminUnpublish() {
-    $admin_user = $this->drupalCreateUser(array('access content overview', 'administer nodes', 'bypass node access'));
+    $admin_user = $this->drupalCreateUser(array('access content overview', 'administer nodes', 'bypass node access', 'access tracker'));
     $this->drupalLogin($admin_user);
 
     $node = $this->drupalCreateNode(array(