Setting Linux ACL permissions using Java Process

Question

I am attempting to change the ACL permissions active on certain files using a result from an API I have built.

executorService.scheduleAtFixedRate(new Runnable() {
                public void run() {
                    System.out.println("hello");
                    JSONArray data = ServerAPI.riskCheck();
                    if(data != null){
                        JSONArray policycontent = data;

                        for(int i = 0; i < policycontent.length(); i++){
                            JSONObject privilege = policycontent.getJSONObject(i);
                            String user = privilege.getString("user");
                            String filepath = privilege.getString("filePath");
                            String accesses = "";
                            if(privilege.getBoolean("read") == true){
                                accesses = accesses + "r";
                            }

                            if(privilege.getBoolean("write") == true){
                                accesses = accesses + "w";
                            }

                            if(privilege.getBoolean("execute") == true){
                                accesses = accesses + "x";
                            }
                            if(privilege.getBoolean("execute") == false && privilege.getBoolean("write") == false && privilege.getBoolean("read") == false){
                                accesses = "-";
                            }
                            try {
                                System.out.println("TRYING TO RUN:");
                                Process p = Runtime.getRuntime().exec("setfacl -m \"u:" + user + ":" + accesses + "\" " + filepath);
                                //p.waitFor();
                                int exitVal = p.waitFor();
                                System.out.println("Exited with error code "+exitVal);



                            } catch (IOException e) {
                                // TODO Auto-generated catch block
                                e.printStackTrace();
                            } catch (InterruptedException e) {
                                // TODO Auto-generated catch block
                                e.printStackTrace();
                            }
                            //System.out.println("setfacl -m \"u:" + user + ":" + accesses + "\" " + filepath);
                        }
                    }
                    System.out.println(ServerAPI.getRiskValue());
                    }
                },1, 1, TimeUnit.SECONDS);              

}

The query to the API is done every 1 second currently, checking as soon as a "risk value" is changed, it will get new permissions.

I am running this as a JAR in the folder with the files upon which the permissions should be enacted.

I am running the JAR as root.

I have attempted to do something as simple as append a line to a file in the same directory as the JAR on each iteration of the loop, however it does not do anything.

Each of the commands is a valid command that works when I run it in the terminal manually. The System.out.println was used to ensure that the command is being interpreted correctly, but seeing as it didn't matter what command I tried, I am running out of ideas.

It also exits with status 0 each time, and I have not been able to debug despite also trying to use processbuilder and variants of that approach, including error outputs.

Is this simply something I can not do using a Java program?

Thanks in advance!

Answer 1

The usual source of this sort of the problem is that Runtime.exec() does not provide a shell. If you want to execute commands in a shell, you'll need to actually execute a shell.

A possible work-around is to create bash shell script containing the commands that you want to run. Put #!/usr/bin/env bash at the top of the script to make sure that it gets run by the bash shell.

Then you can exec() the script, and pass it any arguments that you need to.

Edit - I've done this in the past by creating a single shell script as part of the application installation, not creating it dynamically. If you only need to do one thing, and can parameterize the script, this works well.