See the License for the specific language governing permissions and
limitations under the License.
*/

package app

import (
	"fmt"
	"os"
)

func checkPermissions() error {
	if uid := os.Getuid(); uid != 0 {
		return fmt.Errorf("kubelet needs to run as uid `0`. It is being run as %d", uid)
	}
	// TODO: Check if kubelet is running in the `initial` user namespace.

limitations under the License.
*/

package app

import (
	"errors"
	"os/user"

	"golang.org/x/sys/windows"
	"k8s.io/klog/v2"
)

func checkPermissions() error {

	u, err := user.Current()
	if err != nil {
		klog.ErrorS(err, "Unable to get current user")
		return err
	}

	// For Windows user.UserName contains the login name and user.Name contains

				if !v.Equals(end) {
					t.Errorf("Expected version.txt to contain %s but got %s", end, v)
				}
				// Integration tests are run in a docker container with umask of 0022.
				checkPermissions(t, server.cfg.dataDirectory, 0755|os.ModeDir)
				checkPermissions(t, dataDir.versionFile.path, 0644)
			})
		})
	}
}

func parallel(servers []*EtcdMigrateServer, fn func(server *EtcdMigrateServer)) {
	var wg sync.WaitGroup

	}
	defer updateInProgress.Store(0)

	transport := getUpdateTransport(30 * time.Second)
	opts := selfupdate.Options{
		Hash:     crypto.SHA256,
		Checksum: sha256Sum,
	}

	if err := opts.CheckPermissions(); err != nil {
		return AdminError{
			Code:       AdminUpdateApplyFailure,
			Message:    fmt.Sprintf("server update failed with: %s, do not restart the servers yet", err),

			kubeletDeps, err := UnsecuredDependencies(kubeletServer, utilfeature.DefaultFeatureGate)
			if err != nil {
				return fmt.Errorf("failed to construct kubelet dependencies: %w", err)
			}

			if err := checkPermissions(); err != nil {
				klog.ErrorS(err, "kubelet running with insufficient permissions")
			}

			// make the kubelet's config safe for logging
			config := kubeletServer.KubeletConfiguration.DeepCopy()

        when:
        securityManager.checkPermission(new AllPermission())

        then:
        1 * cl.addURL(entry1.toURI().toURL())
        1 * cl.addURL(entry2.toURI().toURL())
        0 * cl._
        System.getProperty("java.class.path") == [entry1.absolutePath, entry2.absolutePath].join(File.pathSeparator)

        when:
        securityManager.checkPermission(new AllPermission())

        then:
        0 * cl._

    public BootstrapSecurityManager() {
        this(null);
    }

    BootstrapSecurityManager(URLClassLoader target) {
        this.target = target;
    }

    @Override
    public void checkPermission(Permission permission) {
        synchronized (this) {
            if (initialised) {
                return;
            }
            if (System.in == null) {
                // Still starting up

        new PropertyPermission("guava.concurrent.generate_cancellation_cause", "read");
    SecurityManager disallowPropertySecurityManager =
        new SecurityManager() {
          @Override
          public void checkPermission(Permission p) {
            if (readSystemProperty.equals(p)) {
              throw new SecurityException("Disallowed: " + p);
            }
          }
        };

        new SecurityManager() {
          @Override
          public void checkAccess(Thread t) {
            throw new SecurityException();
          }

          @Override
          public void checkPermission(Permission perm) {
            // Do nothing so we can clear the security manager at the end
          }
        });
    try {
      final String oldName = Thread.currentThread().getName();

        new SecurityManager() {
          @Override
          public void checkAccess(Thread t) {
            throw new SecurityException();
          }

          @Override
          public void checkPermission(Permission perm) {
            // Do nothing so we can clear the security manager at the end
          }
        });
    try {
      final String oldName = Thread.currentThread().getName();