File Permissions and FileDescriptor

Every file has permissions that decide who may read, write or execute it. NIO.2 can read and change these with Files.isReadable, Files.getPosixFilePermissions and Files.setPosixFilePermissions on macOS and Linux. Two older classes also have "file" in their names but do different jobs: java.io.FilePermission describes a permission in Java's old security system, and java.io.FileDescriptor is a handle to an open file, such as the standard input and output. In this lesson, you will learn all three, starting with the one you'll use most.

POSIX Permissions

On macOS and Linux, each file has three permission groups, owner, group and others, and three rights in each: r (read), w (write) and x (execute). They are often written as a 9-character string such as rw-r--r--.

Example: Reading and Changing Permissions

Let's see an example that makes a file private and then read-only. It works on macOS and Linux; on Windows, POSIX permissions aren't supported.

import java.io.IOException;
import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.attribute.PosixFilePermissions;
 
public class Perms {
    public static void main(String[] args) throws IOException {
        Path secret = Files.writeString(Path.of("salary.txt"), "Navika: 90000");
 
        Files.setPosixFilePermissions(secret,
            PosixFilePermissions.fromString("rw-------"));
        System.out.println("Private: " + PosixFilePermissions.toString(
            Files.getPosixFilePermissions(secret)));
 
        Files.setPosixFilePermissions(secret,
            PosixFilePermissions.fromString("r--r--r--"));
        System.out.println("Read-only: " + PosixFilePermissions.toString(
            Files.getPosixFilePermissions(secret)));
        System.out.println("Writable? " + Files.isWritable(secret));
    }
}

Private: rw-------
Read-only: r--r--r--
Writable? false

Explanation: rw------- lets only the owner read and write. r--r--r-- lets everyone read and nobody write, so isWritable now returns false. (Running as a system administrator can bypass these checks.)

FilePermission

java.io.FilePermission represents a permission such as "read /data/*" in Java's original Security Manager system. The Security Manager has been permanently disabled since Java 24, so FilePermission only appears in old code and APIs. It doesn't change anything on disk.

FileDescriptor

java.io.FileDescriptor is a low-level handle to an open file or stream, given by the operating system. Its three ready-made values are FileDescriptor.in, FileDescriptor.out and FileDescriptor.err. You rarely need it; one real use is fileOutputStream.getFD().sync(), which forces written data onto the physical disk.

import java.io.FileOutputStream;
import java.io.IOException;
 
public class Sync {
    public static void main(String[] args) throws IOException {
        try (FileOutputStream out = new FileOutputStream("journal.txt")) {
            out.write("Advitha saved a record".getBytes());
            out.getFD().sync();
            System.out.println("Valid descriptor? " + out.getFD().valid());
        }
    }
}

Valid descriptor? true

Explanation: getFD() returns the stream's descriptor. sync() waits until the operating system has really written the data to the disk, which matters for things like journals that must survive a power cut.

Common Mistakes

Calling POSIX methods on Windows. They throw UnsupportedOperationException; check FileSystems.getDefault().supportedFileAttributeViews() for "posix".

Thinking FilePermission changes file rights. It only described Security Manager rules.

Relying on permissions for real security when running as an administrator. Administrators bypass them.

Practice

1. Easy: Print the permissions of three files in your home folder as rwx strings.
2. Harder: Write a method that makes a script file executable for its owner by adding OWNER_EXECUTE to its current permissions.

Key Takeaways