{"record":{"id":"62a9e5354ad29fbd","repo":"eclipse-vertx/vert.x","slug":"accessed-denied-for-chown-on-path","errorCode":null,"errorMessage":"Accessed denied for chown on ${path}","messagePattern":"Accessed denied for chown on (.+?)","errorType":"exception","errorClass":"FileSystemException","httpStatus":null,"severity":"error","filePath":"vertx-core/src/main/java/io/vertx/core/file/impl/FileSystemImpl.java","lineNumber":577,"sourceCode":"      public Void perform() {\n        try {\n          Path target = resolveFile(path).toPath();\n          UserPrincipalLookupService service = target.getFileSystem().getUserPrincipalLookupService();\n          UserPrincipal userPrincipal = user == null ? null : service.lookupPrincipalByName(user);\n          GroupPrincipal groupPrincipal = group == null ? null : service.lookupPrincipalByGroupName(group);\n          if (groupPrincipal != null) {\n            PosixFileAttributeView view = Files.getFileAttributeView(target, PosixFileAttributeView.class, LinkOption.NOFOLLOW_LINKS);\n            if (view == null) {\n              throw new FileSystemException(\"Change group of file not supported\");\n            }\n            view.setGroup(groupPrincipal);\n\n          }\n          if (userPrincipal != null) {\n            Files.setOwner(target, userPrincipal);\n          }\n        } catch (SecurityException e) {\n          throw new FileSystemException(\"Accessed denied for chown on \" + path);\n        } catch (IOException e) {\n          throw new FileSystemException(getFileAccessErrorMessage(\"crown\", path), e);\n        }\n        return null;\n      }\n    };\n  }\n\n  private BlockingAction<FileProps> propsInternal(String path) {\n    return props(path, true);\n  }\n\n  private BlockingAction<FileProps> lpropsInternal(String path) {\n    return props(path, false);\n  }\n\n  private BlockingAction<FileProps> props(String path, boolean followLinks) {\n    Objects.requireNonNull(path);","sourceCodeStart":559,"sourceCodeEnd":595,"githubUrl":"https://github.com/eclipse-vertx/vert.x/blob/fb308bd8c3f12c79f4ae89bef67fadf6c80d036e/vertx-core/src/main/java/io/vertx/core/file/impl/FileSystemImpl.java#L559-L595","documentation":"Vert.x wraps a SecurityException thrown by Files.setOwner (or the principal lookup) during FileSystem.chown into this FileSystemException. A SecurityManager or OS-level authorization refused the owner change on the target path. The message intentionally mirrors the chmod 'Accessed denied' variant.","triggerScenarios":"Calling vertx.fileSystem().chown(path, user, null or group) while a SecurityManager checkAccess(owner) fails, or the JVM user lacks the OS privilege (root/CAP_CHOWN) required to change file ownership.","commonSituations":"Running as a non-root container user while setup code tries to chown files created by another uid; restrictive SecurityManager policies in legacy application servers; changing ownership of files owned by other users.","solutions":["Run the process as root or grant CAP_CHOWN (docker run --cap-add=CHOWN) when ownership changes are genuinely required.","Avoid chown entirely: create the file with the correct owner from the start (same user writes it).","Verify the target path's current owner with fileProps and skip chown when it already matches.","Review the active SecurityManager policy file and grant FilePermission/PropertyPermission as needed."],"exampleFix":"// before\nvertx.fileSystem().chown(\"/app/data\", \"appuser\", null); // SecurityException as non-root\n// after\nFileProps p = vertx.fileSystem().propsBlocking(\"/app/data\");\nif (!\"appuser\".equals(p.owner())) {\n  vertx.fileSystem().chown(\"/app/data\", \"appuser\", null);\n}","handlingStrategy":"try-catch","validationCode":"FileProps props = vertx.fileSystem().propsBlocking(path);\n// skip chown if current owner already matches\ndesiredOwner.equals(props.owner()) -> no-op","typeGuard":null,"tryCatchPattern":"try { vertx.fileSystem().chownBlocking(path, user, null); } catch (FileSystemException e) { throw new IllegalStateException(\"chown requires elevated privileges; run as root or add CAP_CHOWN\", e); }","preventionTips":["Run the app as the user that should own the files","Avoid chown in non-root containers","Prefer volume-configuration over runtime chown","Skip chown when owner already matches"],"tags":["filesystem","chown","security","permissions"],"backgroundTag":"permission-denied","analyzedSha":"fb308bd8c3f12c79f4ae89bef67fadf6c80d036e","analyzedAt":"2026-09-06T11:37:12.241Z","contentChangedAt":"2026-09-06T11:37:12.241Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}