0

I'm getting "Access is denied" when reading a file from my Java program on Windows Server 2012. I've been doing this sort of thing for years so I'm not a newbie. I just can't figure out what I'm missing!

Here is the stack (edited):

Caused by: java.io.FileNotFoundException: C:/ProgramData/MyProgram/resource/file.license (Access is denied)
#0: java.io.FileInputStream.open0(Native Method)
#1: java.io.FileInputStream.open(Unknown Source)
#2: java.io.FileInputStream.<init>(Unknown Source)
#3: java.io.FileInputStream.<init>(Unknown Source)
#4: com...util.FileUtil.readFileAsString(FileUtil.java:269)

The Java program is being run as a Windows Service using NSSM. The service is configured to run as user "cmb@contoso.com". The "file.license" file has user cmb@contoso.com with "Full" access. Domain "Users" group has Read, Read & Execute perms.

The perms on "C:/ProgramData/MyProgram" grant cmb@contoso.com Full access.

If I run Process Explorer and look at the "java.exe" Properties > Security I see that it shows "CONTOSO\cmb" as the user the process is running as.

I tried granting "Everyone" Read, Read & Execute perms on C:\ProgramData\MyProgram and on file.license but that had no effect.

If I run this same code direct, say from Eclipse, it works fine.

The readFileAsString method:

public static String readFileAsString(String filePath) {
    if (filePath == null)
        throw new IllegalArgumentException("No file argument given");

    try {
        byte[] buffer = new byte[(int) new File(filePath).length()];
        FileInputStream f = new FileInputStream(filePath);
        f.read(buffer);
        f.close();

        return new String(buffer);
    } catch (IOException e) {
        throw new OperationFailedException(e);
    }
}

Java is 1.8_111 from Oracle

Process Monitor trace is shown in screenshot: https://drive.google.com/file/d/0B8BMXJDodRtpY19VekRaTkR5bTA/view

Process Monitor security properties of "java.exe" screenshot: https://drive.google.com/file/d/0B8BMXJDodRtpQko0YlVRNkZBQ1k/view

Mike Cooper
  • 1,065
  • 3
  • 13
  • 34
  • 1
    "access is denied" can also mean that another program has the file open for exclusive access, or that your anti-virus software thinks it is malicious. – Harry Johnston Feb 01 '17 at 03:14
  • And if you run the code outside of a service attempting to open the exact same file? Same problem, or not? This will determine if it's a service specific issue or not. – weston Feb 01 '17 at 03:20
  • Interesting that `new File(filePath).length()` works on the line before. – weston Feb 01 '17 at 03:28
  • 1
    @weston "The length, in bytes, of the file denoted by this abstract pathname, or 0L if the file does not exist." so its probably returning zero and just creating an empty array – slipperyseal Feb 01 '17 at 03:42
  • @SlipperySeal nice, check that too Mike – weston Feb 01 '17 at 03:44
  • could be it be something to do with forward slash vs backslashes? but i thought java was pretty good at just converting those transparently. – slipperyseal Feb 01 '17 at 03:51
  • @SlipperySeal No. Java does convert those. If that was the problem it wouldn't be 'access denied'. – user207421 Feb 01 '17 at 04:11
  • @EJP i thought maybe it saw the path as a file in the root directory, which while doesn't exist, might be restricted. i agree this probably isn't the problem. – slipperyseal Feb 01 '17 at 04:14
  • Services can be configured to have restricted access. What does `sc qsidtype myservicename` show? – Harry Johnston Feb 01 '17 at 05:02
  • @westin - Yes I can run the same code from Eclipse to access the same file and it works fine. – Mike Cooper Feb 01 '17 at 17:39
  • @Harry Johnson: The "sc qsidtype" shows SERVICE_SID_TYPE=NONE and also outputs the SERVICE_NAME=cmbserver. Also I don't open this file anywhere other than this code. It's a quick open, read, close. – Mike Cooper Feb 01 '17 at 17:41
  • I assume there are no deny entries in the file's ACL? Have you tried using Process Monitor (available from the MS web site) to see exactly what operation is failing? – Harry Johnston Feb 01 '17 at 21:15
  • There are no DENY entries in the ACL. Thanks for the suggestion on ProcessMonitor. Just tried it but it didn't tell me much more than I already know. I added a link to the screenshot at the end of the post. – Mike Cooper Feb 01 '17 at 22:07
  • I am guessing that this has something to do with NSSM, but I really don't know what its doing that would cause this problem. – Mike Cooper Feb 01 '17 at 22:08
  • Changed the URL of the screenshot to one that should work now. :( – Mike Cooper Feb 02 '17 at 19:12
  • Can you post a screenshot of what Process Explorer shows on the Security tab for the relevant instance of `java.exe` ? Do you have anti-virus software installed? – Harry Johnston Feb 02 '17 at 21:30
  • Added screenshot of Process Explorer Security tab for "java.exe" that is running my code. User "CONTOSO\certaccord" is shown in the tab and is what I have NSSM configured to run as. Same user has Full access to the file being opened. – Mike Cooper Feb 02 '17 at 23:43
  • Let us [continue this discussion in chat](http://chat.stackoverflow.com/rooms/134719/discussion-between-mike-cooper-and-harry-johnston). – Mike Cooper Feb 03 '17 at 01:44

0 Answers0