Reading Windows ACLs from Java

Question

From within a Java program, I want to be able to list out the Windows users and groups who have permission to read a given file. Java has no built-in ability to read the Windows ACL information out (at least until Java 7), so I'm looking for other solutions.

Are there any third party libraries available which can provide direct access to the ACL information for a Windows file?

Failing that, maybe running cacls and capturing and then processing the output would be a reasonable temporary solution - Is the output format of cacls thoroughly documented anywhere, and is it likely to change between versions of Windows?

Answer 1

mdma's answer covers the best approaches for Java 6 but here's a quick example for Java 7:

Path file = Paths.get("c:\\test-file.dat");
AclFileAttributeView aclFileAttributes = Files.getFileAttributeView(
    file, AclFileAttributeView.class);

for (AclEntry aclEntry : aclFileAttributes.getAcl()) {
    System.out.println(aclEntry.principal() + ":");
    System.out.println(aclEntry.permissions() + "\n");
}

Answer 2

If you know the windows APIs, you could use JNA (JNI without the hassle of writing native code) to call the Windows APIs to get the ACL data.

Altenatively here is an article that gets the file security details using VBScript. You could modify this, and have it return the details in a parsable format (e.g. XML). You can invoke a VBScript file by running "cscript.exe", using Runtime.exec() or ProcessBuilder. You can write the ACL info to standard output, and use the streams available on the java.lang.Process to read the process output.

Although exec'ing vbscript might seem a bit hacky, it will get you off to a quick start, since most of the code is already written and working (I presume - I haven't tried the script in the article.) Using the script also avoids needing to map the relevant Win32 apis to java via JNA.