* If access is not allowed, returns an unauthorized error response.
     *
     * @param runtime the action runtime context containing request information
     * @return ActionResponse with unauthorized error if access denied, otherwise delegates to parent
     */
    @Override
    public ActionResponse godHandPrologue(final ActionRuntime runtime) {
        if (!isAccessAllowed()) {

            // neither SHARE_READ nor SHARE_WRITE are set
            this.desiredAccess |= SHARING_DENY_READ_WRITE_EXECUTE;
        }

        this.desiredAccess &= ~0x1; // Win98 doesn't like GENERIC_READ ?! -- get Access Denied.

        // searchAttributes
        this.searchAttributes = SmbConstants.ATTR_DIRECTORY | SmbConstants.ATTR_HIDDEN | SmbConstants.ATTR_SYSTEM;

        // openFunction

            "The client does not have the necessary access rights to perform the requested function.", "Access is denied.",
            "The TID specified was invalid.", "The handle is invalid.", "The network name cannot be found.",

	// Validate that the client cannot remove any objects
	err = minioClient.RemoveObject(ctx, bucket, "someobject", minio.RemoveObjectOptions{})
	if err.Error() != "Access Denied." {
		c.Fatalf("unexpected non-access-denied err: %v", err)
	}
}

func (s *TestSuiteIAM) TestSTSWithGroupPolicy(c *check) {
	ctx, cancel := context.WithTimeout(context.Background(), testDefaultTimeout)
	defer cancel()

            "The client does not have the necessary access rights to perform the requested function.", "Access is denied.",
            "The TID specified was invalid.", "The handle is invalid.", "The network name cannot be found.",

# in compliance with, at your election, the Elastic License 2.0 or the Server
# Side Public License, v 1.

# Checks that we run against bytecode of third-party dependencies
#
# Be judicious about what is denied here: MANY classes will be subject
# to these rules, so please try to keep the false positive rate low!
#
# Each third party .class failing checks will need to be explicitly
# listed in the module's build.gradle file:
#

     * @param path the path to the object within the bucket
     * @return the Blob object, or null if the object does not exist
     * @throws CrawlingAccessException if access is denied
     */
    protected Blob getBlob(final String bucketName, final String path) {
        if (StringUtil.isEmpty(path)) {
            return null;
        }

        try {

	globalCertsCADir = defaultCertsCADir
)

// Get - returns current directory.
func (dir *ConfigDir) Get() string {
	return dir.path
}

// Attempts to create all directories, ignores any permission denied errors.
func mkdirAllIgnorePerm(path string) error {
	err := os.MkdirAll(path, 0o700)
	if err != nil {
		// It is possible in kubernetes like deployments this directory

            normalized = normalized.substring(0, maxLength - 3) + "...";
        }
        return normalized.replace('\n', ' ').replace('\r', ' ').replace('\t', '_');
    }

    /**
     * Log the access denied activity.
     * @param user The user.
     * @param path The path.
     */
    public void accessDenied(final OptionalThing<FessUserBean> user, final String path) {

			//   HTTP status code 404 ("no such key")
			//   error.
			// * if you don’t have the s3:ListBucket
			//   permission, Amazon S3 will return an HTTP
			//   status code 403 ("access denied") error.`
			if globalPolicySys.IsAllowed(policy.BucketPolicyArgs{
				Action:          policy.ListBucketAction,
				BucketName:      bucket,
				ConditionValues: getConditionValues(r, "", auth.AnonymousCredentials),