Java - file.length() returns even if the file is not readable

Question

I have a file from which I have suppressed every permission. No one should be able to read the file, right? In fact, if I run

File f = new File("not_readable.pdf");
System.out.println(f.canRead())

I get

false

However, if I call

File f = new File("not_readable.pdf");
System.out.println(f.length())

I get

455074

It is my understanding that in order to get the size of a file one must open and read the file first, but this result strongly suggests that I'm wrong. Does anyone know why this happens? Also, is there a way to prevent Java's file.length() method from accessing the size of a file?

I am using Ubuntu 12.10

Answer 1

You are mistaken: The length of a file is file system metadata (at least for file systems running under the Linux VFS). Anyone who has read permissions to a directory can see all the contained files and their sizes. To prevent users from seeing a file's size, you have to prevent them from seeing it altogether, i.e. place the file in a directory that has permissions like drwxr-x--- if the user is not in the group associated to the directory, or drwx------ if the user is in that group.

Answer 2

I don't see why you would need read access to view a file's size. In Linux, ls will display the contents of all files in the directory (including their size), even if you have no permissions on them, so long as you have the appropriate permissions on the directory that contains the file. The size of a file is a property of the file allocation table, not the file itself, so length() has no need to inspect the actual file itself (and it would be pretty inefficient for it to get the length by counting the number of bytes in the file).