JDK-4906356 : Add UnixFileOutputStream, UnixFile with permissions support
  • Type: Enhancement
  • Component: core-libs
  • Sub-Component: java.io
  • Affected Version: 1.4.0
  • Priority: P3
  • Status: Closed
  • Resolution: Duplicate
  • OS: solaris_9
  • CPU: sparc
  • Submitted: 2003-08-13
  • Updated: 2003-09-05
  • Resolved: 2003-09-05
Related Reports
Duplicate :  
JDK-4313887 - New I/O: Improved filesystem interface
Description
Current Java file support does not include support for specifying UNIX permissions on files and directories that are created.

This leads to an easy pitfall for Java applications:  they can easily create files or directories with permissions looser than they should be.  I've just filed a P2 security bug against another Sun product the root cause of which was that it used the Java file support to create files and directories and did not take extra care to get their permissions set right.  Particularly vexing is the fact that it's actually somewhat hard to do right - the best theory I've come up with is to create the file or directory using JNI or an external program run through Runtime.exec, and then write to it using core Java.

Such Unix* classes might well live in com.sun.something, though it seems like 3rd parties will need these capabilities too.
Comments
WORK AROUND Create the file or directory using Runtime.exec() before operating on it using core Java methods. It might even be possible to write the classes in the Suggested Fix this way, though of course it would be inefficient.
11-06-2004
SUGGESTED FIX class UnixFileOutputStream extends FileOutputStream { UnixFileOutputStream(FILE file, int permissions) { ... } ... } class UnixFile extends File { ... mkdir(int permissions) { ... } }
11-06-2004