posix: access/accessZ/faccessat/faccessatZ can return AccessDenied or PermissionDenied

[rootbeer]

EACCES is returned if the file mode bit (i.e., user/group/other rwx bits) disallow access (mapped to error.AccessDenied). EPERM is returned if something else denies access (immutable bit, SELinux, capabilities, etc) and is mapped to error.PermissionDenied. This somewhat subtle distinction in errors is part of POSIX, and can happen in practice on Linux or MacOS.

This PR is effectively an update/simplification of (abandoned) PR #19193. See #16782 for deeper problems with the AccessDenied/PermissionDenied duopoly in Zig.

Tested locally with an immutable file.

Fixes #22733 and #19162.

[alexrp]

What do you think about making this PR map both EPERM and EACCES to PermissionDenied for consistency, and then doing a follow-up change that separates PermissionDenied and AccessDenied across the whole standard library? I don't really love the idea of only doing it for these functions in particular.

[rootbeer]

What do you think about making this PR map both EPERM and EACCES to PermissionDenied for consistency, and then doing a follow-up change that separates PermissionDenied and AccessDenied across the whole standard library? I don't really love the idea of only doing it for these functions in particular.

I will make this map both to PermissionDenied for now if that's the least-resistance change.

See #16782 for some notes on the the deeper issues when separating the errors to match the errnos. Its straightforward to directly map each errno to the corresponding Zig error through the std.posix.* calls. However, its not clear to me if the two errors should propagate up through all the std.fs.* and std.os.* APIs too. I can work through it if you're willing to make a call as to which direction the higher layers should go (that is: just one error for all disallowed operations or both AccessDenied/PermissionDenied errors can be returned).

[alexrp]

See #16782 for some notes on the the deeper issues when separating the errors to match the errnos. Its straightforward to directly map each errno to the corresponding Zig error through the std.posix.* calls. However, its not clear to me if the two errors should propagate up through all the std.fs.* and std.os.* APIs too. I can work through it if you're willing to make a call as to which direction the higher layers should go (that is: just one error for all disallowed operations or both AccessDenied/PermissionDenied errors can be returned).

I think having both errors in std.fs is the right call. After all, the std.fs layer has other system-specific errors like InvalidUtf8, InvalidWtf8, BadPathName, NetworkNotFound, AntivirusInterference, ...