{"record":{"id":"e9b6d9ff95fb5588","repo":"eclipse-vertx/vert.x","slug":"accessed-denied-for-chmod-on-path","errorCode":null,"errorMessage":"Accessed denied for chmod on ${path}","messagePattern":"Accessed denied for chmod on (.+?)","errorType":"exception","errorClass":"FileSystemException","httpStatus":null,"severity":"error","filePath":"vertx-core/src/main/java/io/vertx/core/file/impl/FileSystemImpl.java","lineNumber":547,"sourceCode":"          if (dirPermissions != null) {\n            Files.walkFileTree(target, new SimpleFileVisitor<Path>() {\n              public FileVisitResult preVisitDirectory(Path dir, BasicFileAttributes attrs) throws IOException {\n                //The directory entries typically have different permissions to the files, e.g. execute permission\n                //or can't cd into it\n                Files.setPosixFilePermissions(dir, dirPermissions);\n                return FileVisitResult.CONTINUE;\n              }\n\n              public FileVisitResult visitFile(Path file, BasicFileAttributes attrs) throws IOException {\n                Files.setPosixFilePermissions(file, permissions);\n                return FileVisitResult.CONTINUE;\n              }\n            });\n          } else {\n            Files.setPosixFilePermissions(target, permissions);\n          }\n        } catch (SecurityException e) {\n          throw new FileSystemException(\"Accessed denied for chmod on \" + path);\n        } catch (IOException e) {\n          throw new FileSystemException(getFileAccessErrorMessage(\"chmod\", path), e);\n        }\n        return null;\n      }\n    };\n  }\n\n  protected BlockingAction<Void> chownInternal(String path, String user, String group) {\n    Objects.requireNonNull(path);\n    return new BlockingAction<Void>() {\n      public Void perform() {\n        try {\n          Path target = resolveFile(path).toPath();\n          UserPrincipalLookupService service = target.getFileSystem().getUserPrincipalLookupService();\n          UserPrincipal userPrincipal = user == null ? null : service.lookupPrincipalByName(user);\n          GroupPrincipal groupPrincipal = group == null ? null : service.lookupPrincipalByGroupName(group);\n          if (groupPrincipal != null) {","sourceCodeStart":529,"sourceCodeEnd":565,"githubUrl":"https://github.com/eclipse-vertx/vert.x/blob/fb308bd8c3f12c79f4ae89bef67fadf6c80d036e/vertx-core/src/main/java/io/vertx/core/file/impl/FileSystemImpl.java#L529-L565","documentation":"The chmod action catches SecurityException from java.nio.file.Files.setPosixFilePermissions (or the ACP variant) and throws FileSystemException 'Accessed denied for chmod on <path>'. A SecurityException here signals the JVM or OS refused the permission change. Unlike the IOException branch, no cause is attached; the message names only the path.","triggerScenarios":"vertx.fileSystem().chmod(path, perms) on a file not owned by the current user, on a filesystem without POSIX permission support being forced down the POSIX path, or under a Java SecurityManager policy denying the operation.","commonSituations":"chmod'ing files created by a different service user in a shared directory; running the app as non-root and chmod'ing system paths; Docker containers where the app user differs from the volume file owner; SELinux confinement; Windows filesystems where POSIX semantics are emulated.","solutions":["Run the Vert.x process as the owner of the file, or change ownership beforehand (chown) so the app user can chmod it.","Fix the Docker/user mismatch: run the container with the UID owning the mounted volume, or pre-set permissions on the host.","If a SecurityManager is active, grant FilePermission/SecurityPermission for the path in the policy file.","On non-POSIX filesystems, apply permissions out-of-band (icacls on Windows, mount options) instead of fs.chmod."],"exampleFix":"// before\nvertx.fileSystem().chmodBlocking(\"/var/log/app/app.log\", \"rw-r--r--\"); // owned by other user\n// after: align ownership first (host/entrypoint), then chmod as app user\n// entrypoint.sh: chown -R app:app /var/log/app || true\nvertx.fileSystem().chmodBlocking(\"/var/log/app/app.log\", \"rw-r--r--\");","handlingStrategy":"try-catch","validationCode":"Path p = Paths.get(path);\nif (!Files.exists(p)) throw new FileNotFoundException(path);\ntry {\n  Files.getPosixFilePermissions(p);\n} catch (UnsupportedOperationException e) {\n  throw new IllegalStateException(\"Filesystem lacks POSIX permissions: \" + p);\n}\nif (!p.toFile().canWrite() || !isOwner(p))\n  throw new AccessDeniedException(\"not owner of \" + p);","typeGuard":"static boolean canChmod(Path p) {\n  try {\n    return Files.getOwner(p).equals(Files.getFileSystem().getUserPrincipalLookupService()\n        .lookupPrincipalByName(System.getProperty(\"user.name\")));\n  } catch (IOException | UnsupportedOperationException e) { return false; }\n}","tryCatchPattern":"try {\n  fs.chmodBlocking(path, \"rw-r--r--\");\n} catch (FileSystemException e) {\n  if (e.getMessage().startsWith(\"Accessed denied for chmod\")) {\n    // fix ownership out-of-band: chown on host / match container UID\n  } else throw e;\n}","preventionTips":["Run the app as the user that owns the files it chmods","Align container UID/GID with the volume's file owner in Docker/Kubernetes","Don't call chmod on non-POSIX filesystems (Windows/NFS with no POSIX support)","Grant required FilePermissions in the policy if a SecurityManager is enabled"],"tags":["file-system","chmod","permissions","posix"],"backgroundTag":"permission-denied","analyzedSha":"fb308bd8c3f12c79f4ae89bef67fadf6c80d036e","analyzedAt":"2026-09-06T11:37:12.241Z","contentChangedAt":"2026-09-06T11:37:12.241Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}