SecureDirectoryStream.java revision 954
893N/A * Copyright 2007-2009 Sun Microsystems, Inc. All Rights Reserved. 893N/A * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. 893N/A * This code is free software; you can redistribute it and/or modify it 893N/A * under the terms of the GNU General Public License version 2 only, as 893N/A * published by the Free Software Foundation. Sun designates this 954N/A * particular file as subject to the "Classpath" exception as provided 893N/A * by Sun in the LICENSE file that accompanied this code. 893N/A * This code is distributed in the hope that it will be useful, but WITHOUT 893N/A * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 893N/A * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License 893N/A * version 2 for more details (a copy is included in the LICENSE file that 893N/A * accompanied this code). 893N/A * You should have received a copy of the GNU General Public License version 893N/A * 2 along with this work; if not, write to the Free Software Foundation, 893N/A * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. 893N/A * Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, 893N/A * CA 95054 USA or visit www.sun.com if you need additional information or 893N/A * A {@code DirectoryStream} that defines operations on files that are located 893N/A * relative to an open directory. A {@code SecureDirectoryStream} is intended 893N/A * for use by sophisticated or security sensitive applications requiring to 893N/A * traverse file trees or otherwise operate on directories in a race-free manner. 893N/A * Race conditions can arise when a sequence of file operations cannot be 893N/A * carried out in isolation. Each of the file operations defined by this 893N/A * interface specify a relative {@link Path}. All access to the file is relative 893N/A * to the open directory irrespective of if the directory is moved or replaced 893N/A * by an attacker while the directory is open. A {@code SecureDirectoryStream} 893N/A * may also be used as a virtual <em>working directory</em>. 893N/A * <p> A {@code SecureDirectoryStream} requires corresponding support from the 893N/A * underlying operating system. Where an implementation supports this features 893N/A * then the {@code DirectoryStream} returned by the {@link Path#newDirectoryStream 893N/A * newDirectoryStream} method will be a {@code SecureDirectoryStream} and must 893N/A * be cast to that type in order to invoke the methods defined by this interface. 893N/A * <p> As specified by {@code DirectoryStream}, the iterator's {@link 893N/A * java.util.Iterator#remove() remove} method removes the directory entry for 893N/A * the last element returned by the iterator. In the case of a {@code 893N/A * SecureDirectoryStream} the {@code remove} method behaves as if by invoking 893N/A * the {@link #deleteFile deleteFile} or {@link #deleteDirectory deleteDirectory} 893N/A * methods defined by this interface. The {@code remove} may require to examine 893N/A * the file to determine if the file is a directory, and consequently, it may 893N/A * not be atomic with respect to other file system operations. 893N/A * <p> In the case of the default {@link java.nio.file.spi.FileSystemProvider 893N/A * provider}, and a security manager is set, then the permission checks are 893N/A * performed using the path obtained by resolving the given relative path 893N/A * against the <i>original path</i> of the directory (irrespective of if the 893N/A * directory is moved since it was opened). 893N/A * Initialize a new instance of this class. 893N/A * Opens the directory identified by the given path, returning a {@code 893N/A * SecureDirectoryStream} to iterate over the entries in the directory. 893N/A * <p> This method works in exactly the manner specified by the {@link 893N/A * Path#newDirectoryStream newDirectoryStream} method for the case that 893N/A * the {@code path} parameter is an {@link Path#isAbsolute absolute} path. 893N/A * When the parameter is a relative path then the directory to open is 893N/A * relative to this open directory. The {@code followLinks} parameter 893N/A * determines if links should be followed. If this parameter is {@code 893N/A * false} and the file is a symbolic link then this method fails (by 893N/A * throwing an I/O exception). 893N/A * <p> The new directory stream, once created, is not dependent upon the 893N/A * directory stream used to create it. Closing this directory stream has no 893N/A * effect upon newly created directory stream. 908N/A * the path to the directory to open 893N/A * {@code true} if the links should be followed 908N/A * the directory stream filter or {@code null}. 908N/A * @return a new and open {@code SecureDirectoryStream} object 893N/A * @throws ClosedDirectoryStreamException 908N/A * if the directory stream is closed 893N/A * @throws NotDirectoryException 908N/A * if the file could not otherwise be opened because it is not 893N/A * a directory <i>(optional specific exception)</i> 908N/A * if an I/O error occurs 893N/A * @throws SecurityException 893N/A * In the case of the default provider, and a security manager is 893N/A * installed, the {@link SecurityManager#checkRead(String) checkRead} 893N/A * method is invoked to check read access to the directory. 893N/A * Opens or creates a file in this directory, returning a seekable byte 893N/A * channel to access the file. 893N/A * <p> This method works in exactly the manner specified by the {@link 893N/A * Path#newByteChannel Path.newByteChannel} method for the 893N/A * case that the {@code path} parameter is an {@link Path#isAbsolute absolute} 893N/A * path. When the parameter is a relative path then the file to open or 893N/A * create is relative to this open directory. In addition to the options 893N/A * defined by the {@code Path.newByteChannel} method, the {@link 893N/A * LinkOption#NOFOLLOW_LINKS NOFOLLOW_LINKS} option may be used to 893N/A * ensure that this method fails if the file is a symbolic link. 893N/A * <p> The channel, once created, is not dependent upon the directory stream 893N/A * used to create it. Closing this directory stream has no effect upon the 908N/A * the path of the file to open open or create 908N/A * options specifying how the file is opened 908N/A * an optional list of attributes to set atomically when creating 893N/A * @throws ClosedDirectoryStreamException 908N/A * if the directory stream is closed 893N/A * @throws IllegalArgumentException 908N/A * if the set contains an invalid combination of options 893N/A * @throws UnsupportedOperationException 908N/A * if an unsupported open option is specified or the array contains 893N/A * attributes that cannot be set atomically when creating the file 893N/A * @throws FileAlreadyExistsException 908N/A * if a file of that name already exists and the {@link 893N/A * StandardOpenOption#CREATE_NEW CREATE_NEW} option is specified 893N/A * <i>(optional specific exception)</i> 908N/A * if an I/O error occurs 893N/A * @throws SecurityException 893N/A * In the case of the default provider, and a security manager is 893N/A * installed, the {@link SecurityManager#checkRead(String) checkRead} 893N/A * method is invoked to check read access to the path if the file 893N/A * is opened for reading. The {@link SecurityManager#checkWrite(String) 893N/A * checkWrite} method is invoked to check write access to the path 893N/A * if the file is opened for writing. 893N/A * <p> Unlike the {@link FileRef#delete delete()} method, this method 893N/A * does not first examine the file to determine if the file is a directory. 893N/A * Whether a directory is deleted by this method is system dependent and 893N/A * therefore not specified. If the file is a symbolic-link then the link is 893N/A * deleted (not the final target of the link). When the parameter is a 893N/A * relative path then the file to delete is relative to this open directory. 908N/A * the path of the file to delete 893N/A * @throws ClosedDirectoryStreamException 908N/A * if the directory stream is closed 893N/A * @throws NoSuchFileException 908N/A * if the file does not exist <i>(optional specific exception)</i> 908N/A * if an I/O error occurs 893N/A * @throws SecurityException 893N/A * In the case of the default provider, and a security manager is 893N/A * installed, the {@link SecurityManager#checkDelete(String) checkDelete} 893N/A * method is invoked to check delete access to the file 893N/A * <p> Unlike the {@link FileRef#delete delete()} method, this method 893N/A * does not first examine the file to determine if the file is a directory. 893N/A * Whether non-directories are deleted by this method is system dependent and 893N/A * therefore not specified. When the parameter is a relative path then the 893N/A * directory to delete is relative to this open directory. 908N/A * the path of the directory to delete 893N/A * @throws ClosedDirectoryStreamException 908N/A * if the directory stream is closed 893N/A * @throws NoSuchFileException 908N/A * if the the directory does not exist <i>(optional specific exception)</i> 893N/A * @throws DirectoryNotEmptyException 908N/A * if the directory could not otherwise be deleted because it is 893N/A * not empty <i>(optional specific exception)</i> 908N/A * if an I/O error occurs 893N/A * @throws SecurityException 893N/A * In the case of the default provider, and a security manager is 893N/A * installed, the {@link SecurityManager#checkDelete(String) checkDelete} 893N/A * method is invoked to check delete access to the directory 893N/A * Move a file from this directory to another directory. 893N/A * <p> This method works in a similar manner to {@link Path#moveTo moveTo} 893N/A * method when the {@link StandardCopyOption#ATOMIC_MOVE ATOMIC_MOVE} option 893N/A * is specified. That is, this method moves a file as an atomic file system 893N/A * operation. If the {@code srcpath} parameter is an {@link Path#isAbsolute 893N/A * absolute} path then it locates the source file. If the parameter is a 893N/A * relative path then it is located relative to this open directory. If 893N/A * the {@code targetpath} parameter is absolute then it locates the target 893N/A * file (the {@code targetdir} parameter is ignored). If the parameter is 893N/A * a relative path it is located relative to the open directory identified 893N/A * by the {@code targetdir} parameter. In all cases, if the target file 893N/A * exists then it is implementation specific if it is replaced or this 908N/A * the name of the file to move 908N/A * the destination directory 908N/A * the name to give the file in the destination directory 893N/A * @throws ClosedDirectoryStreamException 908N/A * if this or the target directory stream is closed 893N/A * @throws FileAlreadyExistsException 908N/A * if the file already exists in the target directory and cannot 893N/A * be replaced <i>(optional specific exception)</i> 893N/A * @throws AtomicMoveNotSupportedException 908N/A * if the file cannot be moved as an atomic file system operation 908N/A * if an I/O error occurs 893N/A * @throws SecurityException 893N/A * In the case of the default provider, and a security manager is 893N/A * installed, the {@link SecurityManager#checkWrite(String) checkWrite} 893N/A * method is invoked to check write access to both the source and 893N/A * Returns a new file attribute view to access the file attributes of this 893N/A * <p> The resulting file attribute view can be used to read or update the 893N/A * attributes of this (open) directory. The {@code type} parameter specifies 893N/A * the type of the attribute view and the method returns an instance of that 893N/A * type if supported. Invoking this method to obtain a {@link 893N/A * BasicFileAttributeView} always returns an instance of that class that is 893N/A * bound to this open directory. 893N/A * <p> The state of resulting file attribute view is intimately connected 893N/A * to this directory stream. Once the directory stream is {@link #close closed}, 893N/A * then all methods to read or update attributes will throw {@link 893N/A * ClosedDirectoryStreamException ClosedDirectoryStreamException}. 908N/A * the {@code Class} object corresponding to the file attribute view 908N/A * @return a new file attribute view of the specified type bound to 893N/A * this directory stream, or {@code null} if the attribute view 893N/A * type is not available 893N/A * Returns a new file attribute view to access the file attributes of a file 893N/A * <p> The resulting file attribute view can be used to read or update the 893N/A * attributes of file in this directory. The {@code type} parameter specifies 893N/A * the type of the attribute view and the method returns an instance of that 893N/A * type if supported. Invoking this method to obtain a {@link 893N/A * BasicFileAttributeView} always returns an instance of that class that is 893N/A * bound to the file in the directory. 893N/A * <p> The state of resulting file attribute view is intimately connected 893N/A * to this directory stream. Once the directory stream {@link #close closed}, 893N/A * then all methods to read or update attributes will throw {@link 893N/A * ClosedDirectoryStreamException ClosedDirectoryStreamException}. The 893N/A * file is not required to exist at the time that the file attribute view 893N/A * is created but methods to read or update attributes of the file will 893N/A * fail when invoked and the file does not exist. 908N/A * the {@code Class} object corresponding to the file attribute view 908N/A * options indicating how symbolic links are handled 908N/A * @return a new file attribute view of the specified type bound to a 893N/A * this directory stream, or {@code null} if the attribute view 893N/A * type is not available