AttributeView
, FileAttributeView
, FileOwnerAttributeView
public interface AclFileAttributeView extends FileOwnerAttributeView
ACLs are used to specify access rights to file system objects. An ACL is an ordered list of access-control-entries
, each specifying a UserPrincipal
and the level of access for that user principal. This file attribute view defines the getAcl
, and setAcl
methods to read and write ACLs based on the ACL model specified in RFC 3530: Network File System (NFS) version 4 Protocol. This file attribute view is intended for file system implementations that support the NFSv4 ACL model or have a well-defined mapping between the NFSv4 ACL model and the ACL model used by the file system. The details of such mapping are implementation dependent and are therefore unspecified.
This class also extends FileOwnerAttributeView
so as to define methods to get and set the file owner.
When a file system provides access to a set of file-systems
that are not homogeneous then only some of the file systems may support ACLs. The supportsFileAttributeView
method can be used to test if a file system supports ACLs.
OWNER@
", "GROUP@
", and "EVERYONE@
". When both the AclFileAttributeView
and the PosixFileAttributeView
are supported then these special user identities may be included in ACL entries
that are read or written. The file system's UserPrincipalLookupService
may be used to obtain a UserPrincipal
to represent these special identities by invoking the lookupPrincipalByName
method. Usage Example: Suppose we wish to add an entry to an existing ACL to grant "joe" access:
// lookup "joe"
UserPrincipal joe = file.getFileSystem().getUserPrincipalLookupService()
.lookupPrincipalByName("joe");
// get view
AclFileAttributeView view = Files.getFileAttributeView(file, AclFileAttributeView.class);
// create ACE to give "joe" read access
AclEntry entry = AclEntry.newBuilder()
.setType(AclEntryType.ALLOW)
.setPrincipal(joe)
.setPermissions(AclEntryPermission.READ_DATA, AclEntryPermission.READ_ATTRIBUTES)
.build();
// read ACL, insert ACE, re-write ACL
List<AclEntry> acl = view.getAcl();
acl.add(0, entry); // insert before any DENY entries
view.setAcl(acl);
Where dynamic access to file attributes is required, the attributes supported by this attribute view are as follows:
Name Type "acl" List
<AclEntry
>"owner" UserPrincipal
The getAttribute
method may be used to read the ACL or owner attributes as if by invoking the getAcl
or getOwner
methods.
The setAttribute
method may be used to update the ACL or owner attributes as if by invoking the setAcl
or setOwner
methods.
Implementations supporting this attribute view may also support setting the initial ACL when creating a file or directory. The initial ACL may be provided to methods such as createFile
or createDirectory
as an FileAttribute
with name
"acl:acl"
and a value
that is the list of AclEntry
objects.
Where an implementation supports an ACL model that differs from the NFSv4 defined ACL model then setting the initial ACL when creating the file must translate the ACL to the model supported by the file system. Methods that create a file should reject (by throwing IOException
) any attempt to create a file that would be less secure as a result of the translation.
getOwner, setOwner
String name()
"acl"
.name
in interface AttributeView
name
in interface FileOwnerAttributeView
List<AclEntry> getAcl() throws IOException
When the file system uses an ACL model that differs from the NFSv4 defined ACL model, then this method returns an ACL that is the translation of the ACL to the NFSv4 ACL model.
The returned list is modifiable so as to facilitate changes to the existing ACL. The setAcl
method is used to update the file's ACL attribute.
entries
representing the ACLIOException
- if an I/O error occursSecurityException
- In the case of the default provider, a security manager is installed, and it denies RuntimePermission
("accessUserInformation")
or its checkRead
method denies read access to the file.void setAcl(List<AclEntry> acl) throws IOException
Where the file system supports Access Control Lists, and it uses an ACL model that differs from the NFSv4 defined ACL model, then this method must translate the ACL to the model supported by the file system. This method should reject (by throwing IOException
) any attempt to write an ACL that would appear to make the file more secure than would be the case if the ACL were updated. Where an implementation does not support a mapping of AclEntryType.AUDIT
or AclEntryType.ALARM
entries, then this method ignores these entries when writing the ACL.
If an ACL entry contains a user-principal
that is not associated with the same provider as this attribute view then ProviderMismatchException
is thrown. Additional validation, if any, is implementation dependent.
If the file system supports other security related file attributes (such as a file access-permissions
for example), the updating the access control list may also cause these security related attributes to be updated.
acl
- the new access control listIOException
- if an I/O error occurs or the ACL is invalidSecurityException
- In the case of the default provider, a security manager is installed, it denies RuntimePermission
("accessUserInformation")
or its checkWrite
method denies write access to the file.
© 1993, 2023, Oracle and/or its affiliates. All rights reserved.
Documentation extracted from Debian's OpenJDK Development Kit package.
Licensed under the GNU General Public License, version 2, with the Classpath Exception.
Various third party code in OpenJDK is licensed under different licenses (see Debian package).
Java and OpenJDK are trademarks or registered trademarks of Oracle and/or its affiliates.
https://docs.oracle.com/en/java/javase/21/docs/api/java.base/java/nio/file/attribute/AclFileAttributeView.html