t.Fatalf("Unable to create file %v. %v", slashpath.Join(permDeniedDir, "mybucket", "myobject"), err)
	}

	if err = os.Chmod(slashpath.Join(permDeniedDir, "mybucket"), 0o400); err != nil {
		t.Fatalf("Unable to change permission to temporary directory %v. %v", slashpath.Join(permDeniedDir, "mybucket"), err)
	}
	t.Cleanup(func() {
		os.Chmod(slashpath.Join(permDeniedDir, "mybucket"), 0o775)

			return
		}
	}

	for _, bucket := range bucketsInConflict.ToSlice() {
		dnsLogIf(ctx, fmt.Errorf("Unable to add bucket DNS entry for bucket %s, an entry exists for the same bucket by a different tenant. This local bucket will be ignored. Bucket names are globally unique in federated deployments. Use path style requests on following addresses '%v' to access this bucket", bucket, globalDomainIPs.ToSlice()))
	}

	restrictedClient := s.getUserClient(c, "restricted", "restricted123", "")

	buckets, err := restrictedClient.ListBuckets(ctx)
	if err != nil {
		c.Fatalf("err fetching buckets %s", err)
	}
	if len(buckets) != 2 || buckets[0].Name != "bucket1" || buckets[1].Name != "bucket2" {
		c.Fatalf("restricted service account should only have access to bucket1 and bucket2")
	}

	// Try to escalate privileges

			z.ReplicatedCount, err = dc.ReadInt64()
			if err != nil {
				err = msgp.WrapError(err, "ReplicatedCount")
				return
			}
		case "Bucket":
			z.Bucket, err = dc.ReadString()
			if err != nil {
				err = msgp.WrapError(err, "Bucket")
				return
			}
		case "Object":
			z.Object, err = dc.ReadString()
			if err != nil {
				err = msgp.WrapError(err, "Object")
				return

		return ObjectInfo{}, -1, VersionNotFound{Bucket: bucket, Object: object, VersionID: opts.VersionID}
	}
	return ObjectInfo{}, -1, ObjectNotFound{Bucket: bucket, Object: object}
}

func (z *erasureServerPools) GetObjectInfo(ctx context.Context, bucket, object string, opts ObjectOptions) (objInfo ObjectInfo, err error) {
	if err = checkGetObjArgs(ctx, bucket, object); err != nil {
		return objInfo, err
	}

Klaus Post <******@****.***> 1759093161 +0200

	buckets, err := listBucketsLocal(context.Background(), *opts)
	if err != nil {
		return nil, grid.NewRemoteErr(err)
	}
	res := aoBucketInfo.New()
	for i := range buckets {
		bucket := buckets[i]
		res.Append(&bucket)
	}
	return res, nil
}

// HeadBucketHandler implements peer BucketInfo call, returns bucket create date.

			return
		}
		for _, dnsRecords := range dnsBuckets {
			buckets = append(buckets, BucketInfo{
				Name:    dnsRecords[0].Key,
				Created: dnsRecords[0].CreationDate,
			})
		}
		sort.Slice(buckets, func(i, j int) bool {
			return buckets[i].Name < buckets[j].Name
		})
	} else {
		buckets, err = objectAPI.ListBuckets(ctx, BucketOptions{Cached: true})
		if err != nil {

		{"volatile-bucket-1", "", "", "", 1000, ListObjectsInfo{}, BucketNotFound{Bucket: "volatile-bucket-1"}, false},
		{"volatile-bucket-2", "", "", "", 1000, ListObjectsInfo{}, BucketNotFound{Bucket: "volatile-bucket-2"}, false},
		{"volatile-bucket-3", "", "", "", 1000, ListObjectsInfo{}, BucketNotFound{Bucket: "volatile-bucket-3"}, false},
		// If marker is *after* the last possible object from the prefix it should return an empty list.

		if err != nil && !errors.Is(err, BucketLifecycleNotFound{Bucket: bucket}) {
			return objInfo, err
		}
		rcfg, err = globalBucketObjectLockSys.Get(bucket)
		if err != nil {
			return objInfo, err
		}
		replcfg, err = getReplicationConfig(ctx, bucket)
		if err != nil {
			return objInfo, err
		}
	}

	// expiration attempted on a bucket with no lifecycle
	// rules shall be rejected.