Java AclEntryPermission类代码示例

import java.nio.file.attribute.AclEntryPermission; //导入依赖的package包/类
private static void makeFileNonReadable(String file) throws IOException {
    Path filePath = Paths.get(file);
    Set<String> supportedAttr = filePath.getFileSystem().supportedFileAttributeViews();

    if (supportedAttr.contains("posix")) {
        Files.setPosixFilePermissions(filePath, PosixFilePermissions.fromString("-w--w----"));
    } else if (supportedAttr.contains("acl")) {
        UserPrincipal fileOwner = Files.getOwner(filePath);

        AclFileAttributeView view = Files.getFileAttributeView(filePath, AclFileAttributeView.class);

        AclEntry entry = AclEntry.newBuilder()
                .setType(AclEntryType.DENY)
                .setPrincipal(fileOwner)
                .setPermissions(AclEntryPermission.READ_DATA)
                .build();

        List<AclEntry> acl = view.getAcl();
        acl.add(0, entry);
        view.setAcl(acl);
    }
}
 

import java.nio.file.attribute.AclEntryPermission; //导入依赖的package包/类
@Override
public boolean checkAccessAllowed(CloudPath path, UserPrincipal userOrGroup,
		Set<AclEntryPermission> checkPermissions) {
	// Get the view for the path
	CloudFileAttributesView cloudFileAttributeView = Files.getFileAttributeView(path, CloudFileAttributesView.class);
	
	if (cloudFileAttributeView == null) {
		LOG.warn("Could not get {} attribute view from path {}", CloudFileAttributesView.class, path);
		return false;
	}

	CloudAclFileAttributes aclFileAttributes;
	try {
		aclFileAttributes = cloudFileAttributeView.readAttributes();
	} catch (IOException e) {
		LOG.warn("Could not read ACL file attributes for {}", path);
		return false;
	}
	
	return checkAccessAllowed(aclFileAttributes.getAclSet(), userOrGroup, checkPermissions);
}
 

import java.nio.file.attribute.AclEntryPermission; //导入依赖的package包/类
/**
 * File access is checked using {@link #checkAccess(BlobStoreContext, CloudPath, Set)}
 * always with {@link AclEntryPermission#WRITE_DATA} and {@link AclEntryPermission#ADD_FILE},
 * and optionally with {@link AclEntryPermission#APPEND_DATA} if <em>options</em> contains
 * {@link StandardOpenOption#APPEND}.
 * @see	CloudFileChannel
 */
@Override
public CloudFileChannel newByteChannel(BlobStoreContext context, CloudPath path,
		Set<? extends OpenOption> options, FileAttribute<?>... attrs) throws IOException {
	EnumSet<AclEntryPermission> channelPerms = EnumSet.noneOf(AclEntryPermission.class);
	options.forEach(o -> {
		AclEntryPermission aclPerm = openOptionToAclEntryPermission(o);
		if (aclPerm != null) {
			channelPerms.add(aclPerm);
		}
	});

	// Check the parent path for file add
	if (channelPerms.remove(AclEntryPermission.ADD_FILE)) {
		checkAccess(context, path.getParent(), CREATE_NEW_FILE_PERMS);
	}

	// Check file access if the file exists
	if (path.exists()) {
		checkAccess(context, path, channelPerms);
	}
	
	// Create the channel
	return new CloudFileChannel(context, path, getCloudFileChannelTransport(), options, attrs);
}
 

import java.nio.file.attribute.AclEntryPermission; //导入依赖的package包/类
/**
 * Transforms a {@link StandardOpenOption} into an {@link AclEntryPermission}. Other
 * {@link OpenOption} types are ignored.
 * @param o
 * @return The option as an ACL permission or null if this is not applicable.
 */
protected AclEntryPermission openOptionToAclEntryPermission(OpenOption o) {
	if (o instanceof StandardOpenOption) {
		switch ((StandardOpenOption)o) {
			case APPEND: return AclEntryPermission.APPEND_DATA;
			case CREATE: return AclEntryPermission.ADD_FILE;
			case CREATE_NEW: return AclEntryPermission.ADD_FILE;
			case DELETE_ON_CLOSE: return AclEntryPermission.DELETE;
			case READ: return AclEntryPermission.READ_DATA;
			case TRUNCATE_EXISTING: return AclEntryPermission.APPEND_DATA;
			case WRITE: return AclEntryPermission.WRITE_DATA;
			default: return null;
		}
	}

	return null;
}
 

import java.nio.file.attribute.AclEntryPermission; //导入依赖的package包/类
/**
 * <p>
 * This constructor can only discern some very basic permissions. It assumes that because you have access
 * to this container then you have all CRUD operation access. This may not be true. More sophisticated
 * implementations should be able to tell the exact permissions.
 * </p>
 * <p>
 * There is a lone {@link CloudAclEntry} created which has the default permissions. It is of type
 * {@link PublicPrivateCloudPermissionsPrincipal}.
 * </p>
 * <p>
 * Subclasses may implement different permissions.
 * </p>
 */
public CloudAclFileAttributes(CloudAclEntryConflictChecker conflictChecker, BlobMetadata blobMetadata, BlobAccess blobAccess) {
	super(blobMetadata);
	aclSet = new CloudAclEntrySet(AnonymousUserPrincipal.INSTANCE, conflictChecker);
	CloudAclEntry<PublicPrivateCloudPermissionsPrincipal> entry =
		new CloudAclEntryBuilder<>(PublicPrivateCloudPermissionsPrincipal.class)
			.addPermissions(AclEntryPermission.READ_DATA, AclEntryPermission.WRITE_DATA, AclEntryPermission.APPEND_DATA,
					AclEntryPermission.ADD_FILE, AclEntryPermission.ADD_SUBDIRECTORY,
					AclEntryPermission.DELETE, AclEntryPermission.DELETE_CHILD, AclEntryPermission.LIST_DIRECTORY,
					AclEntryPermission.READ_ACL, AclEntryPermission.WRITE_ACL,
					AclEntryPermission.READ_ATTRIBUTES, AclEntryPermission.READ_ATTRIBUTES)
			.setType(AclEntryType.ALLOW)
			.setPrincipal(new PublicPrivateCloudPermissionsPrincipal(blobAccess))
			.build();
	addAcl(AnonymousUserPrincipal.INSTANCE, entry);
}
 

import java.nio.file.attribute.AclEntryPermission; //导入依赖的package包/类
@Override
public void checkAccess(Path path, AccessMode... modes) throws IOException {
	CloudPath cloudPath = getCloudPath(path);
	CloudFileSystemImplementation sourceCloudFileSystemImplementation = getCloudFileSystemImplementation(cloudPath);

	// Work out permissions to check
	Set<AclEntryPermission> checkPermissions = EnumSet.noneOf(AclEntryPermission.class);
	Arrays.stream(modes).forEach(m ->
			{
				if (AccessMode.EXECUTE.equals(m)) {
					checkPermissions.add(AclEntryPermission.EXECUTE);
				} else if (AccessMode.READ.equals(m)) {
					checkPermissions.add(AclEntryPermission.READ_DATA);
				} else if (AccessMode.WRITE.equals(m)) {
					checkPermissions.add(AclEntryPermission.WRITE_DATA);
				}
			});

	sourceCloudFileSystemImplementation.checkAccess(getBlobStoreContext(cloudPath), cloudPath, checkPermissions);
}
 

import java.nio.file.attribute.AclEntryPermission; //导入依赖的package包/类
boolean hasPermissions(EnumSet<AclEntryPermission> permissions) {
	CloudHostConfiguration cloudHostConfiguration = cloudPath.getFileSystem().getCloudHostConfiguration();
	CloudHostSecurityManager cloudHostSecurityManager = cloudHostConfiguration.getCloudHostSecurityManager();
	UserGroupLookupService<?> userPrincipalLookupService =
			cloudHostConfiguration.getUserGroupLookupService();

	if (cloudHostSecurityManager == null) {
		// No security manager, allow access
		LOG.debug("No {} found in cloud host configuration {}, default action is to allow all access",
				CloudHostSecurityManager.class, cloudHostConfiguration);
		return true;
	}

	UserPrincipal currentUser = null; // Anonymous
	if (userPrincipalLookupService != null) {
		currentUser = userPrincipalLookupService.getCurrentUser();
	} else {
		LOG.debug("Cannot find current user, no {} in cloud host configuration {}",
				UserGroupLookupService.class, cloudHostConfiguration);
		currentUser = AnonymousUserPrincipal.INSTANCE;
	}

	return cloudHostSecurityManager.checkAccessAllowed(cloudPath, currentUser, permissions);
}
 

import java.nio.file.attribute.AclEntryPermission; //导入依赖的package包/类
@Test
public void testDoesUserHaveAccessFailsForAUserWithAnAnonymousGroupAllowRuleButAnonymousUserDenyRule() {
	UserPrincipal user = new TestUserImpl("user1");
	CloudAclEntry<GroupPrincipal> entry1 = new CloudAclEntryBuilder<GroupPrincipal>(GroupPrincipal.class)
		.addPermission(AclEntryPermission.ADD_FILE)
		.setType(AclEntryType.ALLOW)
		.setPrincipal(AnonymousGroupPrincipal.INSTANCE)
		.build();
	CloudAclEntry<UserPrincipal> entry2 = new CloudAclEntryBuilder<UserPrincipal>(UserPrincipal.class)
			.addPermission(AclEntryPermission.ADD_FILE)
			.setType(AclEntryType.DENY)
			.setPrincipal(new AnonymousUserPrincipal())
			.build();
	CloudAclEntrySet assetPermissions = new CloudAclEntrySet(AnonymousUserPrincipal.INSTANCE, entry1, entry2);
	Assert.assertFalse(mgr.doesUserHaveAccess(assetPermissions, user, null, EnumSet.of(AclEntryPermission.ADD_FILE)));
}
 

import java.nio.file.attribute.AclEntryPermission; //导入依赖的package包/类
@Test
public void testDoesUserHaveAccessFailsForAUserGroupWithAnAllowRuleAndAUserWithADenyRule() {
	UserPrincipal user = new TestUserImpl("user1");
	CloudAclEntry<UserPrincipal> entry1 = new CloudAclEntryBuilder<UserPrincipal>(UserPrincipal.class)
		.addPermission(AclEntryPermission.ADD_FILE)
		.setType(AclEntryType.DENY)
		.setPrincipal(user)
		.build();
	GroupPrincipal group1 = new TestGroupImpl("group1");
	GroupPrincipal group2 = new TestGroupImpl("group2");
	Set<GroupPrincipal> userGroups = Sets.newHashSet(group1, group2);
	CloudAclEntry<GroupPrincipal> entry2 = new CloudAclEntryBuilder<GroupPrincipal>(GroupPrincipal.class)
			.addPermission(AclEntryPermission.ADD_FILE)
			.setType(AclEntryType.ALLOW)
			.setPrincipal(group2)
			.build();
	CloudAclEntrySet assetPermissions = new CloudAclEntrySet(AnonymousUserPrincipal.INSTANCE, entry1, entry2);
	Assert.assertFalse(mgr.doesUserHaveAccess(assetPermissions, user, userGroups, EnumSet.of(AclEntryPermission.ADD_FILE)));
}
 

import java.nio.file.attribute.AclEntryPermission; //导入依赖的package包/类
@Test
public void testDoesUserHaveAccessSucceedsForAUserPrincipalWithMultipleCheckPermissionsAndMultipleAssetPermissionsAllowed() {
	UserPrincipal user = new TestUserImpl("user1");
	CloudAclEntry<UserPrincipal> entry1 = new CloudAclEntryBuilder<UserPrincipal>(UserPrincipal.class)
		.addPermissions(AclEntryPermission.ADD_FILE, AclEntryPermission.ADD_SUBDIRECTORY, AclEntryPermission.WRITE_ACL)
		.setType(AclEntryType.ALLOW)
		.setPrincipal(user)
		.build();
	CloudAclEntrySet assetPermissions = new CloudAclEntrySet(AnonymousUserPrincipal.INSTANCE, entry1);
	Assert.assertTrue(mgr.doesUserHaveAccess(assetPermissions, user, null,
			EnumSet.of(AclEntryPermission.ADD_FILE, AclEntryPermission.WRITE_ACL)));
	Assert.assertTrue(mgr.doesUserHaveAccess(assetPermissions, user, null,
			EnumSet.of(AclEntryPermission.ADD_SUBDIRECTORY, AclEntryPermission.WRITE_ACL)));
	Assert.assertTrue(mgr.doesUserHaveAccess(assetPermissions, user, null,
			EnumSet.of(AclEntryPermission.ADD_FILE, AclEntryPermission.ADD_SUBDIRECTORY, AclEntryPermission.WRITE_ACL)));
}
 

import java.nio.file.attribute.AclEntryPermission; //导入依赖的package包/类
@Test
public void testIsConflictingAclWillDetermineThatAnAllowAndDenyForTheSamePermissionsForAUserConflicts() {
	UserPrincipal user1 = new TestUserImpl("user1");
	UserPrincipal user2 = new TestUserImpl("user1");

	CloudAclEntry<UserPrincipal> cloudAclEntry1 = new CloudAclEntryBuilder<UserPrincipal>(UserPrincipal.class)
		.setPrincipal(user1)
		.setType(AclEntryType.DENY)
		.addPermissions(AclEntryPermission.ADD_FILE, AclEntryPermission.ADD_SUBDIRECTORY)
		.build();

	CloudAclEntry<UserPrincipal> cloudAclEntry2 = new CloudAclEntryBuilder<UserPrincipal>(UserPrincipal.class)
			.setPrincipal(user2)
			.setType(AclEntryType.ALLOW)
			.addPermissions(AclEntryPermission.DELETE, AclEntryPermission.ADD_SUBDIRECTORY)
			.build();

	Assert.assertTrue(checker.isConflictingAcl(cloudAclEntry1, cloudAclEntry2));
}
 

import java.nio.file.attribute.AclEntryPermission; //导入依赖的package包/类
@Test
public void testIsConflictingAclWillDetermineThatAnAllowAndDenyForDifferentUsersDoesNotConflict() {
	UserPrincipal user1 = new TestUserImpl("user1");
	UserPrincipal user2 = new TestUserImpl("user2");

	CloudAclEntry<UserPrincipal> cloudAclEntry1 = new CloudAclEntryBuilder<UserPrincipal>(UserPrincipal.class)
		.setPrincipal(user1)
		.setType(AclEntryType.DENY)
		.addPermissions(AclEntryPermission.ADD_FILE, AclEntryPermission.ADD_SUBDIRECTORY)
		.build();

	CloudAclEntry<UserPrincipal> cloudAclEntry2 = new CloudAclEntryBuilder<UserPrincipal>(UserPrincipal.class)
			.setPrincipal(user2)
			.setType(AclEntryType.ALLOW)
			.addPermissions(AclEntryPermission.DELETE, AclEntryPermission.ADD_SUBDIRECTORY)
			.build();

	Assert.assertFalse(checker.isConflictingAcl(cloudAclEntry1, cloudAclEntry2));
}
 

import java.nio.file.attribute.AclEntryPermission; //导入依赖的package包/类
@Test
public void testIsConflictingAclWillDetermineThatAnAllowAndDenyForTheSamePermissionsForAGroupConflicts() {
	GroupPrincipal group1 = new TestGroupImpl("group1");
	GroupPrincipal group2 = new TestGroupImpl("group1");

	CloudAclEntry<GroupPrincipal> cloudAclEntry1 = new CloudAclEntryBuilder<GroupPrincipal>(GroupPrincipal.class)
		.setPrincipal(group1)
		.setType(AclEntryType.DENY)
		.addPermissions(AclEntryPermission.ADD_FILE, AclEntryPermission.ADD_SUBDIRECTORY)
		.build();

	CloudAclEntry<GroupPrincipal> cloudAclEntry2 = new CloudAclEntryBuilder<GroupPrincipal>(GroupPrincipal.class)
			.setPrincipal(group2)
			.setType(AclEntryType.ALLOW)
			.addPermissions(AclEntryPermission.ADD_SUBDIRECTORY)
			.build();

	Assert.assertTrue(checker.isConflictingAcl(cloudAclEntry1, cloudAclEntry2));
}
 

import java.nio.file.attribute.AclEntryPermission; //导入依赖的package包/类
@Test
public void testIsConflictingAclWillDetermineThatAnAllowAndDenyForDifferentGroupsDoesNotConflict() {
	GroupPrincipal group1 = new TestGroupImpl("group1");
	GroupPrincipal group2 = new TestGroupImpl("group2");

	CloudAclEntry<GroupPrincipal> cloudAclEntry1 = new CloudAclEntryBuilder<GroupPrincipal>(GroupPrincipal.class)
		.setPrincipal(group1)
		.setType(AclEntryType.DENY)
		.addPermissions(AclEntryPermission.ADD_FILE, AclEntryPermission.ADD_SUBDIRECTORY)
		.build();

	CloudAclEntry<GroupPrincipal> cloudAclEntry2 = new CloudAclEntryBuilder<GroupPrincipal>(GroupPrincipal.class)
			.setPrincipal(group2)
			.setType(AclEntryType.ALLOW)
			.addPermissions(AclEntryPermission.ADD_SUBDIRECTORY)
			.build();

	Assert.assertFalse(checker.isConflictingAcl(cloudAclEntry1, cloudAclEntry2));
}
 

import java.nio.file.attribute.AclEntryPermission; //导入依赖的package包/类
@Test
public void testIsConflictingAclWillReturnFalseForAUserNotInAGroup() {
	UserPrincipal user1 = new TestUserImpl("user1");
	GroupPrincipal group2 = new TestGroupImpl("group1");

	CloudAclEntry<UserPrincipal> cloudAclEntry1 = new CloudAclEntryBuilder<UserPrincipal>(UserPrincipal.class)
		.setPrincipal(user1)
		.setType(AclEntryType.DENY)
		.addPermissions(AclEntryPermission.ADD_FILE, AclEntryPermission.ADD_SUBDIRECTORY)
		.build();

	CloudAclEntry<GroupPrincipal> cloudAclEntry2 = new CloudAclEntryBuilder<GroupPrincipal>(GroupPrincipal.class)
			.setPrincipal(group2)
			.setType(AclEntryType.ALLOW)
			.addPermissions(AclEntryPermission.ADD_SUBDIRECTORY)
			.build();

	Assert.assertFalse(checker.isConflictingAcl(cloudAclEntry1, cloudAclEntry2));
}