diff --git a/CHANGES.txt b/CHANGES.txt
index 67672cd0c5..4332b75555 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -1,4 +1,5 @@
 4.0.18
+ * Grant permission on keyspaces system_views and system_virtual_schema not possible (CASSANDRA-20171)
  * Avoid computing prepared statement size for unprepared batches (CASSANDRA-20556)
  * Fix Dropwizard Meter causes timeouts when infrequently used (CASSANDRA-19332)
  * Update OWASP dependency checker to version 12.1.0 (CASSANDRA-20501)
diff --git a/src/java/org/apache/cassandra/auth/DataResource.java b/src/java/org/apache/cassandra/auth/DataResource.java
index c3f5b3210e..32120df97a 100644
--- a/src/java/org/apache/cassandra/auth/DataResource.java
+++ b/src/java/org/apache/cassandra/auth/DataResource.java
@@ -24,6 +24,7 @@ import com.google.common.collect.Sets;
 import org.apache.commons.lang3.StringUtils;
 
 import org.apache.cassandra.schema.Schema;
+import org.apache.cassandra.schema.SchemaConstants;
 
 /**
  * The primary type of resource in Cassandra.
@@ -209,7 +210,8 @@ public class DataResource implements IResource
             case ROOT:
                 return true;
             case KEYSPACE:
-                return Schema.instance.getKeyspaces().contains(keyspace);
+                return SchemaConstants.isVirtualSystemKeyspace(keyspace) ||
+                       Schema.instance.getKeyspaces().contains(keyspace);
             case TABLE:
                 return Schema.instance.getTableMetadata(keyspace, table) != null;
         }
diff --git a/test/unit/org/apache/cassandra/auth/GrantAndRevokeTest.java b/test/unit/org/apache/cassandra/auth/GrantAndRevokeTest.java
index 3572fafb11..c2bdc90857 100644
--- a/test/unit/org/apache/cassandra/auth/GrantAndRevokeTest.java
+++ b/test/unit/org/apache/cassandra/auth/GrantAndRevokeTest.java
@@ -40,6 +40,7 @@ import org.apache.cassandra.schema.TableMetadata;
 import org.apache.cassandra.cql3.CQLTester;
 import org.apache.cassandra.db.SystemKeyspace;
 import org.apache.cassandra.utils.Pair;
+import org.apache.cassandra.service.CassandraDaemon;
 
 import static java.lang.String.format;
 import static org.apache.cassandra.schema.SchemaConstants.LOCAL_SYSTEM_KEYSPACE_NAMES;
@@ -66,6 +67,7 @@ public class GrantAndRevokeTest extends CQLTester
         DatabaseDescriptor.getRoleManager().setup();
         DatabaseDescriptor.getAuthenticator().setup();
         DatabaseDescriptor.getAuthorizer().setup();
+        CassandraDaemon.getInstanceForTesting().setupVirtualKeyspaces();
     }
 
     @After
@@ -302,6 +304,18 @@ public class GrantAndRevokeTest extends CQLTester
 
     }
 
+    @Test
+    public void testGrantOnVirtualKeyspaces() throws Throwable
+    {
+        Session superuser = session(SUPERUSER);
+        superuser.execute(String.format("CREATE ROLE %s WITH LOGIN = TRUE AND password='%s'", user, pass));
+
+        superuser.execute(String.format("GRANT SELECT PERMISSION ON KEYSPACE system_virtual_schema TO %s", user));
+        superuser.execute(String.format("GRANT SELECT PERMISSION ON KEYSPACE system_views TO %s", user));
+        superuser.execute(String.format("REVOKE SELECT PERMISSION ON KEYSPACE system_virtual_schema FROM %s", user));
+        superuser.execute(String.format("REVOKE SELECT PERMISSION ON KEYSPACE system_views FROM %s", user));
+    }
+
     private void maybeReadSystemTables(Session session, boolean isSuper) throws Throwable
     {
         Set<String> readableKeyspaces = new HashSet<>(Arrays.asList(SchemaConstants.SCHEMA_KEYSPACE_NAME, SchemaConstants.TRACE_KEYSPACE_NAME));