# Test Case: access - Denied Operations

**Test ID**: TC058-access-denied
**Category**: VFS Integration
**Priority**: High

## Objective

Verify direct access checks distinguish permission denial from read-only
modification denial for a non-root credential.

## Procedure

Mount vfs/vfs-plain.erofs and run:

    su -m nobody -c './g3_vfs_probe expect-error access-read /tmp/repo22-g3/mnt/testdir/rootonly.txt 13'
    su -m nobody -c './g3_vfs_probe expect-error access-read /tmp/repo22-g3/mnt/testdir/writeonly.txt 13'
    su -m nobody -c './g3_vfs_probe expect-error access-exec /tmp/repo22-g3/mnt/testdir/noexec.txt 13'
    su -m nobody -c './g3_vfs_probe expect-error access-write /tmp/repo22-g3/mnt/testdir/file.txt 30'

## Expected Results

Mode-bit denials report EACCES (13); requested modification of the regular
file reports EROFS (30). Record exact helper output and cleanup.