File permissions for a given user

[Chris]

How can I check whether a given user has certain permissions on a certain
file (say, read access)? The user may not be the same one that started the
JVM.

 

[enrique]

Can you clarify more on how this Java app gets started, and how other
people (none of whom started the app) interact with it?

 

[Chris]

Can you clarify more on how this Java app gets started, and how other

people (none of whom started the app) interact with it?

It's a webapp, running in a J2EE server. Users log in. The app decides
whether they can see certain files or not. It has to check with the
operating system to see if they have read access to the files before it
gives them up.

 

[Betty]

It's a webapp, running in a J2EE server. Users log in. The app decides
whether they can see certain files or not. It has to check with the
operating system to see if they have read access to the files before it
gives them up.

Why don't you just let them try to access the files and if they
are not worthy there will be an error you can handle gracefully.

 

[Chris]

Can you clarify more on how this Java app gets started, and how other

Why don't you just let them try to access the files and if they
are not worthy there will be an error you can handle gracefully.

This would work, except we're not allowed to show them that the files exist
at all. A user should not get a directory listing for a directory they don't
have rights to.

 

[Thomas Weidenfeller]

This would work, except we're not allowed to show them that the files exist
at all. A user should not get a directory listing for a directory they don't
have rights to.

Such a layer of protection should be handled by the operating system,
not the application. It is trivial to circumvent such application-level
filtering - by using another application, e.g. a simple file browser.
Security by obscurity is not a good idea.

/Thomas

 

[enrique]

I would just give each user their own shell account. Skip the web
thing. If these files aren't even web pages, why go through the
trouble of presenting them from a web application?