t.Fatal("error expected")
	}
	t.Logf("Error (expecting wrapped fs.ErrPermission):\n%v", err)

	if !errors.Is(err, fs.ErrPermission) {
		t.Errorf("error should be a wrapped ErrPermission: %#v", err)
	}

	// TestFS is expected to return a list of errors.
	// Enforce that the list can be extracted for browsing.
	var errs interface{ Unwrap() []error }
	if !errors.As(err, &errs) {

	{nil, false},
	{&fs.PathError{Err: fs.ErrPermission}, true},
	{&os.SyscallError{Err: fs.ErrPermission}, true},
}

func TestIsPermission(t *testing.T) {
	for _, tt := range isPermissionTests {
		if got := os.IsPermission(tt.err); got != tt.want {
			t.Errorf("os.IsPermission(%#v) = %v; want %v", tt.err, got, tt.want)
		}
		if got := errors.Is(tt.err, fs.ErrPermission); got != tt.want {

		case nil:
			return exePath, nil
		case ErrPermission:
			return "", ErrPermission
		}
	}
	return "", ErrNotExist
}

// isExecutable returns an error if a given file is not an executable.
func isExecutable(path string) error {
	stat, err := Stat(path)
	if err != nil {
		return err
	}
	mode := stat.Mode()
	if !mode.IsRegular() {
		return ErrPermission
	}
	if (mode & 0111) == 0 {
		return ErrPermission

	return c.client.Version(ctx)
}

func (c *kesConn) APIs(ctx context.Context) ([]madmin.KMSAPI, error) {
	APIs, err := c.client.APIs(ctx)
	if err != nil {
		if errors.Is(err, kes.ErrNotAllowed) {
			return nil, ErrPermission
		}
		return nil, Error{
			Code:    http.StatusInternalServerError,
			APICode: "kms:InternalError",
			Err:     "failed to list KMS APIs",
			Cause:   err,
		}
	}

// report that permission is denied. It is satisfied by [ErrPermission] as well
// as some syscall errors.
//
// This function predates [errors.Is]. It only supports errors returned by
// the os package. New code should use errors.Is(err, fs.ErrPermission).
func IsPermission(err error) bool {
	return underlyingErrorIs(err, ErrPermission)
}

// IsTimeout returns a boolean indicating whether the error is known

			return true
		case syscall.EINVAL:
			// Some containers return EINVAL instead of EPERM if a system call is
			// denied by security policy.
			return true
		}
	}

	if errors.Is(err, fs.ErrPermission) || errors.Is(err, errors.ErrUnsupported) {
		return true
	}

	return false

		Enclave: c.enclave,
		Name:    req.Name,
	}); err != nil {
		if errors.Is(err, kms.ErrKeyExists) {
			return ErrKeyExists
		}
		if errors.Is(err, kms.ErrPermission) {
			return ErrPermission
		}
		return errKeyCreationFailed(err)
	}
	return nil
}

func (c *kmsConn) GenerateKey(ctx context.Context, req *GenerateKeyRequest) (DEK, error) {

// along with this program.  If not, see <http://www.gnu.org/licenses/>.

package kms

import (
	"fmt"
	"net/http"
)

var (
	// ErrPermission is an error returned by the KMS when it has not
	// enough permissions to perform the operation.
	ErrPermission = Error{
		Code:    http.StatusForbidden,
		APICode: "kms:NotAuthorized",
		Err:     "insufficient permissions to perform KMS operation",
	}

//
// These types are defined here to permit the syscall package to reference them.
package oserror

import "errors"

var (
	ErrInvalid    = errors.New("invalid argument")
	ErrPermission = errors.New("permission denied")
	ErrExist      = errors.New("file already exists")
	ErrNotExist   = errors.New("file does not exist")
	ErrClosed     = errors.New("file already closed")

// Sigquit is the signal to send to kill a hanging subprocess.
// On Unix we send SIGQUIT, but on non-Unix we only have os.Kill.
var Sigquit = os.Kill

func syscallIsNotSupported(err error) bool {
	return errors.Is(err, fs.ErrPermission) || errors.Is(err, errors.ErrUnsupported)