java.nio.file.attribute.AclEntry Java Examples

private static void makeFileNonReadable(String file) throws IOException {
    Path filePath = Paths.get(file);
    Set<String> supportedAttr = filePath.getFileSystem().supportedFileAttributeViews();

    if (supportedAttr.contains("posix")) {
        Files.setPosixFilePermissions(filePath, PosixFilePermissions.fromString("-w--w----"));
    } else if (supportedAttr.contains("acl")) {
        UserPrincipal fileOwner = Files.getOwner(filePath);

        AclFileAttributeView view = Files.getFileAttributeView(filePath, AclFileAttributeView.class);

        AclEntry entry = AclEntry.newBuilder()
                .setType(AclEntryType.DENY)
                .setPrincipal(fileOwner)
                .setPermissions(AclEntryPermission.READ_DATA)
                .build();

        List<AclEntry> acl = view.getAcl();
        acl.add(0, entry);
        view.setAcl(acl);
    }
}
 

@Test
public void testView() throws IOException {
  AclFileAttributeView view =
      provider.view(
          fileLookup(),
          ImmutableMap.<String, FileAttributeView>of(
              "owner", new OwnerAttributeProvider().view(fileLookup(), NO_INHERITED_VIEWS)));
  assertNotNull(view);

  assertThat(view.name()).isEqualTo("acl");

  assertThat(view.getAcl()).isEqualTo(defaultAcl);

  view.setAcl(ImmutableList.<AclEntry>of());
  view.setOwner(FOO);

  assertThat(view.getAcl()).isEqualTo(ImmutableList.<AclEntry>of());
  assertThat(view.getOwner()).isEqualTo(FOO);

  assertThat(file.getAttribute("acl", "acl")).isEqualTo(ImmutableList.<AclEntry>of());
}
 

private AclEntry createConfigurationAccessACLEntry(UserPrincipal user) {
    AclEntry entry = AclEntry
            .newBuilder()
            .setType(AclEntryType.ALLOW)
            .setPrincipal(user)
            .setPermissions(
                    AclEntryPermission.WRITE_NAMED_ATTRS,
                    AclEntryPermission.WRITE_DATA,
                    AclEntryPermission.WRITE_ATTRIBUTES,
                    AclEntryPermission.READ_ATTRIBUTES,
                    AclEntryPermission.APPEND_DATA,
                    AclEntryPermission.READ_DATA,
                    AclEntryPermission.READ_NAMED_ATTRS,
                    AclEntryPermission.READ_ACL,
                    AclEntryPermission.SYNCHRONIZE,
                    AclEntryPermission.DELETE)
            .setFlags(AclEntryFlag.FILE_INHERIT)
            .build();
    return entry;
}
 

private static List<FileAttribute<List<AclEntry>>> getAclAttributes(Path file) throws IOException {
    if (Files.exists(file) && supportsFileOwnerAttributeView(file, AclFileAttributeView.class)) {
        AclFileAttributeView aclView = Files.getFileAttributeView(file, AclFileAttributeView.class);
        if (aclView != null) {
            final List<AclEntry> entries = aclView.getAcl();
            return Collections.singletonList(new FileAttribute<List<AclEntry>>() {

                @Override
                public List<AclEntry> value() {
                    return entries;
                }

                @Override
                public String name() {
                    return "acl:acl";
                }

            });
        }
    }
    return Collections.emptyList();
}
 

void fixSshKeyOnWindows(File key) throws GitException {
    if (launcher.isUnix()) return;

    Path file = Paths.get(key.toURI());

    AclFileAttributeView fileAttributeView = Files.getFileAttributeView(file, AclFileAttributeView.class);
    if (fileAttributeView == null) return;

    try {
        UserPrincipal userPrincipal = fileAttributeView.getOwner();
        AclEntry aclEntry = AclEntry.newBuilder()
            .setType(AclEntryType.ALLOW)
            .setPrincipal(userPrincipal)
            .setPermissions(ACL_ENTRY_PERMISSIONS)
            .build();
        fileAttributeView.setAcl(Collections.singletonList(aclEntry));
    } catch (IOException | UnsupportedOperationException e) {
        throw new GitException("Error updating file permission for \"" + key.getAbsolutePath() + "\"", e);
    }
}
 

public static void fixSshKeyOnWindows(Path file) {
    AclFileAttributeView fileAttributeView = Files
        .getFileAttributeView(file, AclFileAttributeView.class);
    if (fileAttributeView == null) return;

    try {
        UserPrincipal userPrincipal = fileAttributeView.getOwner();
        AclEntry aclEntry = AclEntry.newBuilder()
            .setType(AclEntryType.ALLOW)
            .setPrincipal(userPrincipal)
            .setPermissions(ACL_ENTRY_PERMISSIONS)
            .build();
        fileAttributeView.setAcl(Collections.singletonList(aclEntry));
    } catch (IOException | UnsupportedOperationException e) {
        throw new IllegalStateException("Error updating file permission for \"" + file + "\"", e);
    }
}
 

private void addExecPermission(final Path helm) throws IOException {
	Set<String> fileAttributeView = FileSystems.getDefault().supportedFileAttributeViews();

	if (fileAttributeView.contains("posix")) {
		final Set<PosixFilePermission> permissions;
		try {
			permissions = Files.getPosixFilePermissions(helm);
		} catch (UnsupportedOperationException e) {
			getLog().debug("Exec file permission is not set", e);
			return;
		}
		permissions.add(PosixFilePermission.OWNER_EXECUTE);
		Files.setPosixFilePermissions(helm, permissions);

	} else if (fileAttributeView.contains("acl")) {
		String username = System.getProperty("user.name");
		UserPrincipal userPrincipal = FileSystems.getDefault().getUserPrincipalLookupService().lookupPrincipalByName(username);
		AclEntry aclEntry = AclEntry.newBuilder().setPermissions(AclEntryPermission.EXECUTE).setType(AclEntryType.ALLOW).setPrincipal(userPrincipal).build();

		AclFileAttributeView acl = Files.getFileAttributeView(helm, AclFileAttributeView.class, LinkOption.NOFOLLOW_LINKS);
		List<AclEntry> aclEntries = acl.getAcl();
		aclEntries.add(aclEntry);
		acl.setAcl(aclEntries);
	}
}
 

private void makeKeyFileReadOnly(File file) throws IOException
{
    if(isPosixFileSystem(file))
    {
        Files.setPosixFilePermissions(file.toPath(), EnumSet.of(PosixFilePermission.OWNER_READ));
    }
    else if(isAclFileSystem(file))
    {
        AclFileAttributeView attributeView = Files.getFileAttributeView(file.toPath(), AclFileAttributeView.class);
        ArrayList<AclEntry> acls = new ArrayList<>(attributeView.getAcl());
        ListIterator<AclEntry> iter = acls.listIterator();
        file.setReadOnly();
        while(iter.hasNext())
        {
            AclEntry acl = iter.next();
            Set<AclEntryPermission> originalPermissions = acl.permissions();
            Set<AclEntryPermission> updatedPermissions = EnumSet.copyOf(originalPermissions);

            if(updatedPermissions.removeAll(EnumSet.of(AclEntryPermission.APPEND_DATA,
                                                       AclEntryPermission.DELETE,
                                                       AclEntryPermission.EXECUTE,
                                                       AclEntryPermission.WRITE_ACL,
                                                       AclEntryPermission.WRITE_DATA,
                                                       AclEntryPermission.WRITE_ATTRIBUTES,
                                                       AclEntryPermission.WRITE_NAMED_ATTRS,
                                                       AclEntryPermission.WRITE_OWNER)))
            {
                AclEntry.Builder builder = AclEntry.newBuilder(acl);
                builder.setPermissions(updatedPermissions);
                iter.set(builder.build());
            }
        }
        attributeView.setAcl(acls);
    }
    else
    {
        throw new IllegalArgumentException(ILLEGAL_ARG_EXCEPTION);
    }
}
 

@Test
public void test_windows_file_permission_is_set_correctly() throws Exception {
    fixSshKeyOnWindows(file);
    assertEquals(1, fileAttributeView.getAcl().size());
    AclEntry aclEntry = fileAttributeView.getAcl().get(0);
    assertTrue(aclEntry.flags().isEmpty());
    assertEquals(ACL_ENTRY_PERMISSIONS, aclEntry.permissions());
    assertEquals(userPrincipal, aclEntry.principal());
    assertEquals(AclEntryType.ALLOW, aclEntry.type());
}
 

@Test
public void test_windows_file_permission_are_incorrect() throws Exception {
    // By default files include System and builtin administrators
    assertNotSame(1, fileAttributeView.getAcl().size());
    for (AclEntry entry : fileAttributeView.getAcl()) {
        if (entry.principal().equals(userPrincipal)) {
            assertNotSame(ACL_ENTRY_PERMISSIONS, entry.permissions());
        }
    }
}
 

@Test
public void test_windows_file_permission_are_incorrect() throws Exception {
    // By default files include System and builtin administrators
    assertNotSame(1, fileAttributeView.getAcl().size());
    for (AclEntry entry : fileAttributeView.getAcl()) {
        if (entry.principal().equals(userPrincipal)) {
            assertNotSame(CliGitAPIImpl.ACL_ENTRY_PERMISSIONS, entry.permissions());
        }
    }
}
 

@Test
public void test_windows_file_permission_is_set_correctly() throws Exception {
    cliGit.fixSshKeyOnWindows(file);
    assertEquals(1, fileAttributeView.getAcl().size());
    AclEntry aclEntry = fileAttributeView.getAcl().get(0);
    assertTrue(aclEntry.flags().isEmpty());
    assertEquals(CliGitAPIImpl.ACL_ENTRY_PERMISSIONS, aclEntry.permissions());
    assertEquals(userPrincipal, aclEntry.principal());
    assertEquals(AclEntryType.ALLOW, aclEntry.type());
}
 

private static void makeWritable(Path dir, boolean writable) throws IOException {
  FileStore fileStore = Files.getFileStore(dir);
  if (fileStore.supportsFileAttributeView("posix")) {
    if (writable) {
      Files.setPosixFilePermissions(dir, writablePerms);
    } else {
      Files.setPosixFilePermissions(dir, nonWritablePerms);
    }
  } else if (fileStore.supportsFileAttributeView("acl")) {
    // windows, we hope
    UserPrincipal authenticatedUsers =
        dir.getFileSystem()
            .getUserPrincipalLookupService()
            .lookupPrincipalByName("Authenticated Users");
    AclEntry entry =
        AclEntry.newBuilder()
            .setType(writable ? AclEntryType.ALLOW : AclEntryType.DENY)
            .setPrincipal(authenticatedUsers)
            .setPermissions(
                AclEntryPermission.DELETE,
                AclEntryPermission.DELETE_CHILD,
                AclEntryPermission.ADD_FILE,
                AclEntryPermission.ADD_SUBDIRECTORY)
            .build();

    AclFileAttributeView view = Files.getFileAttributeView(dir, AclFileAttributeView.class);
    List<AclEntry> acl = view.getAcl();
    acl.add(0, entry);
    view.setAcl(acl);
  } else {
    throw new UnsupportedOperationException("no recognized attribute view");
  }
}
 

public static void setReadOnlyPerms(Path path, boolean executable) throws IOException {
  FileStore fileStore = Files.getFileStore(path);
  if (fileStore.supportsFileAttributeView("posix")) {
    if (executable) {
      Files.setPosixFilePermissions(path, readOnlyExecPerms);
    } else {
      Files.setPosixFilePermissions(path, readOnlyPerms);
    }
  } else if (fileStore.supportsFileAttributeView("acl")) {
    // windows, we hope
    UserPrincipal authenticatedUsers =
        path.getFileSystem()
            .getUserPrincipalLookupService()
            .lookupPrincipalByName("Authenticated Users");
    AclEntry denyWriteEntry =
        AclEntry.newBuilder()
            .setType(AclEntryType.DENY)
            .setPrincipal(authenticatedUsers)
            .setPermissions(AclEntryPermission.APPEND_DATA, AclEntryPermission.WRITE_DATA)
            .build();
    AclEntry execEntry =
        AclEntry.newBuilder()
            .setType(executable ? AclEntryType.ALLOW : AclEntryType.DENY)
            .setPrincipal(authenticatedUsers)
            .setPermissions(AclEntryPermission.EXECUTE)
            .build();

    AclFileAttributeView view = Files.getFileAttributeView(path, AclFileAttributeView.class);
    List<AclEntry> acl = view.getAcl();
    acl.add(0, execEntry);
    acl.add(0, denyWriteEntry);
    view.setAcl(acl);
  } else {
    throw new UnsupportedOperationException("no recognized attribute view");
  }
}
 

private Set<AclEntryPermission> getOwnerPermissions(Collection<AclEntry> entries, UserPrincipal owner) {
    Set<AclEntryPermission> set = new HashSet<>();
    for (AclEntry aclEntry : entries) {
        if (aclEntry.principal().equals(owner)) {
            Set<AclEntryPermission> permissions = aclEntry.permissions();
            for (AclEntryPermission aclEntryPermission : permissions) {
                set.add(aclEntryPermission);
            }
        }
    }
    return set;
}
 

@Override
public ImmutableMap<String, ?> defaultValues(Map<String, ?> userProvidedDefaults) {
  Object userProvidedAcl = userProvidedDefaults.get("acl:acl");

  ImmutableList<AclEntry> acl = DEFAULT_ACL;
  if (userProvidedAcl != null) {
    acl = toAcl(checkType("acl", "acl", userProvidedAcl, List.class));
  }

  return ImmutableMap.of("acl:acl", acl);
}
 

@SuppressWarnings("unchecked") // only cast after checking each element's type
private static ImmutableList<AclEntry> toAcl(List<?> list) {
  ImmutableList<?> copy = ImmutableList.copyOf(list);
  for (Object obj : copy) {
    if (!(obj instanceof AclEntry)) {
      throw new IllegalArgumentException(
          "invalid element for attribute 'acl:acl': should be List<AclEntry>, "
              + "found element of type "
              + obj.getClass());
    }
  }

  return (ImmutableList<AclEntry>) copy;
}
 

/**
 * Sample for mapping permissions from a source repository to Cloud Search
 * ACLs. In this example, NFS file system ACls are used as the source
 * permissions.
 *
 * @return Acl
 * @throws IOException if unable to read file permissions
 */
// [START cloud_search_nfs_acl]
static Acl mapNfsAclToCloudSearchAcl(Path pathToFile) throws IOException {
  // Id of the identity source for external user/group IDs. Shown here,
  // but may be omitted in the SDK as it is automatically applied
  // based on the `api.identitySourceId` configuration parameter.
  String identitySourceId = "abcdef12345";

  // Retrieve the file system ACLs
  AclFileAttributeView aclView = Files.getFileAttributeView(
      pathToFile,
      AclFileAttributeView.class,
      LinkOption.NOFOLLOW_LINKS);

  if (aclView == null) {
    // Can't read, return empty ACl
    return new Acl.Builder().build();
  }

  // Owner, for search quality and owner: filters
  // Note that for principals the name is not the primary
  // email address in Cloud Directory, but the local ID defined
  // by the OS. Users and groups must be referred to by their
  // external ID and mapped via an identity source. The SDK
  // will automatically prepend the identity source prefix based on
  // the `api.identitySourceId` configuration parameter.
  List<Principal> owners = Collections.singletonList(
      Acl.getUserPrincipal(aclView.getOwner().getName(), identitySourceId)
  );
  // Principals allowed to access item
  List<Principal> allowedReaders = new ArrayList<>();
  // Principals denied access to item
  List<Principal> deniedReaders = new ArrayList<>();

  for(AclEntry entry: aclView.getAcl()) {
    UserPrincipal fsPrincipal = entry.principal();
    Principal cloudSearchPrincipal = fsPrincipal instanceof GroupPrincipal ?
        Acl.getGroupPrincipal(fsPrincipal.getName(), identitySourceId) :
        Acl.getUserPrincipal(fsPrincipal.getName(), identitySourceId);
    if (entry.type() == AclEntryType.ALLOW) {
      allowedReaders.add(cloudSearchPrincipal);
    } else if (entry.type() == AclEntryType.DENY) {
      deniedReaders.add(cloudSearchPrincipal);
    }
  }

  // Build the Cloud Search ACL. Note that inheritance of permissions
  // from parents is omitted. See `setInheritFrom()` and `setInheritanceType()`
  // methods on the builder if required by your implementation.
  return new Acl.Builder()
      .setReaders(allowedReaders)
      .setDeniedReaders(deniedReaders)
      .setOwners(owners)
      .build();
}
 

@Override
public void setFileAccessControl(final ServerSession session, final SftpSubsystemProxy subsystem,
		final Path file, final List<AclEntry> acl, final LinkOption... options) throws IOException {
	throw new UnsupportedOperationException("ACL set not supported");
}
 

@Override
public void setAcl(List<AclEntry> acl) throws IOException {
  checkNotNull(acl);
  lookupFile().setAttribute("acl", "acl", ImmutableList.copyOf(acl));
}
 

@SuppressWarnings("unchecked")
@Override
public List<AclEntry> getAcl() throws IOException {
  return (List<AclEntry>) lookupFile().getAttribute("acl", "acl");
}
 

private List<AclEntry> getLocalAclEntries(ItemType type, List<AclEntry> parentAclList, List<AclEntry> childAclList)
{
	List<AclEntry> aclList = new ArrayList<>();

	for (AclEntry childEntry : childAclList)
	{
		boolean found = false;
		for (AclEntry parentEntry : parentAclList)
		{
			if (!parentEntry.type().equals(childEntry.type())) continue;
			if (!parentEntry.principal().equals(childEntry.principal())) continue;
			if (!parentEntry.permissions().equals(childEntry.permissions())) continue;
			if (!parentEntry.flags().equals(childEntry.flags()))
			{
				if (parentEntry.flags().contains(AclEntryFlag.INHERIT_ONLY))
				{
					found = true;
					break;
				}
				else
				{
					if (type.equals(ItemType.FOLDER))
					{
						if (parentEntry.flags().contains(AclEntryFlag.DIRECTORY_INHERIT))
						{
							found = true;
							break;
						}
					}
					else
					{
						if (parentEntry.flags().contains(AclEntryFlag.FILE_INHERIT))
						{
							found = true;
							break;
						}
					}
				}
				continue;
			}
			found = true;
			break;
		}

		if (found) continue;

		// System.out.println("CHILD: "+childEntry.toString());
		/*
		 * System.out.println("\n\n");
		 * System.out.println("CHILD: "+childEntry.toString());
		 * 
		 * for(AclEntry parentEntry : parentAclList){
		 * 
		 * System.out.println("PARENT: "+parentEntry.toString()); }
		 * 
		 * System.out.println("\n\n");
		 */

		aclList.add(childEntry);
	}
	return aclList;
}
 

@Override
public void testCopy() throws Exception {
	super.testCopy();
	
	CloverURI source;
	CloverURI target;
	CopyResult result;
	
	source = relativeURI("W.TMP");
	if (manager.exists(source)) { // case insensitive file system
		target = relativeURI("w.tmp");
		result = manager.copy(source, target);
		assertFalse(result.success());
		assertTrue(manager.exists(source));
	}
	
	{
		// CLO-4658:
		source = relativeURI("unreadable.tmp");
		target = relativeURI("unreadable_destination/");
		manager.create(source);
		manager.create(target);
		File file = new File(source.getAbsoluteURI().getSingleURI().toURI());
		Path path = file.toPath();
		assertTrue(file.exists());
		if (!file.setReadable(false)) {
			AclFileAttributeView view = Files.getFileAttributeView(path, AclFileAttributeView.class);
			UserPrincipal owner = view.getOwner();
			List<AclEntry> acl = view.getAcl();
			for (ListIterator<AclEntry> it = acl.listIterator(); it.hasNext(); ) {
				AclEntry entry = it.next();
				if (entry.principal().equals(owner)) {
					Set<AclEntryPermission> permissions = entry.permissions();
					permissions.remove(AclEntryPermission.READ_DATA);
					AclEntry.Builder builder = AclEntry.newBuilder(entry);
					builder.setPermissions(permissions);
					it.set(builder.build());
					break;
				}
			}
			view.setAcl(acl);
		}
		assertFalse(Files.isReadable(path));
		result = manager.copy(source, target);
		assertFalse(result.success());
		assertFalse(manager.exists(relativeURI("unreadable_destination/unreadable.tmp")));
	}
	
}
 

private static void setPermissionsToOwnerOnlyWindows(File file) throws IOException {
  Path path = Paths.get(file.getAbsolutePath());
  FileOwnerAttributeView fileAttributeView =
      Files.getFileAttributeView(path, FileOwnerAttributeView.class);
  UserPrincipal owner = fileAttributeView.getOwner();

  // get view
  AclFileAttributeView view = Files.getFileAttributeView(path, AclFileAttributeView.class);

  // All available entries
  Set<AclEntryPermission> permissions =
      ImmutableSet.of(
          AclEntryPermission.APPEND_DATA,
          AclEntryPermission.DELETE,
          AclEntryPermission.DELETE_CHILD,
          AclEntryPermission.READ_ACL,
          AclEntryPermission.READ_ATTRIBUTES,
          AclEntryPermission.READ_DATA,
          AclEntryPermission.READ_NAMED_ATTRS,
          AclEntryPermission.SYNCHRONIZE,
          AclEntryPermission.WRITE_ACL,
          AclEntryPermission.WRITE_ATTRIBUTES,
          AclEntryPermission.WRITE_DATA,
          AclEntryPermission.WRITE_NAMED_ATTRS,
          AclEntryPermission.WRITE_OWNER);

  // create ACL to give owner everything
  AclEntry entry =
      AclEntry.newBuilder()
          .setType(AclEntryType.ALLOW)
          .setPrincipal(owner)
          .setPermissions(permissions)
          .build();

  // Overwrite the ACL with only this permission
  try {
    view.setAcl(ImmutableList.of(entry));
  } catch (SecurityException ex) {
    throw new IOException("Unable to set permissions for " + file, ex);
  }
}
 

private void checkFilePermissions(String fileLocation, File file) throws IOException
{
    if(isPosixFileSystem(file))
    {
        Set<PosixFilePermission> permissions = Files.getPosixFilePermissions(file.toPath());

        if (permissions.contains(PosixFilePermission.GROUP_READ)
                || permissions.contains(PosixFilePermission.OTHERS_READ)
                || permissions.contains(PosixFilePermission.GROUP_WRITE)
                || permissions.contains(PosixFilePermission.OTHERS_WRITE)) {
            throw new IllegalArgumentException("Key file '"
                    + fileLocation
                    + "' has incorrect permissions.  Only the owner "
                    + "should be able to read or write this file.");
        }
    }
    else if(isAclFileSystem(file))
    {
        AclFileAttributeView attributeView = Files.getFileAttributeView(file.toPath(), AclFileAttributeView.class);
        ArrayList<AclEntry> acls = new ArrayList<>(attributeView.getAcl());
        ListIterator<AclEntry> iter = acls.listIterator();
        UserPrincipal owner = Files.getOwner(file.toPath());
        while(iter.hasNext())
        {
            AclEntry acl = iter.next();
            if(acl.type() == AclEntryType.ALLOW)
            {
                Set<AclEntryPermission> originalPermissions = acl.permissions();
                Set<AclEntryPermission> updatedPermissions = EnumSet.copyOf(originalPermissions);


                if (updatedPermissions.removeAll(EnumSet.of(AclEntryPermission.APPEND_DATA,
                        AclEntryPermission.EXECUTE,
                        AclEntryPermission.WRITE_ACL,
                        AclEntryPermission.WRITE_DATA,
                        AclEntryPermission.WRITE_OWNER))) {
                    throw new IllegalArgumentException("Key file '"
                            + fileLocation
                            + "' has incorrect permissions.  The file should not be modifiable by any user.");
                }
                if (!owner.equals(acl.principal()) && updatedPermissions.removeAll(EnumSet.of(AclEntryPermission.READ_DATA))) {
                    throw new IllegalArgumentException("Key file '"
                            + fileLocation
                            + "' has incorrect permissions.  Only the owner should be able to read from the file.");
                }
            }
        }
    }
    else
    {
        throw new IllegalArgumentException(ILLEGAL_ARG_EXCEPTION);
    }
}