Q:

Acces to files outside WEB-INF

I'm going to use web3j library inside servlet on Tomcat8 web-server on Linux server (Ubuntu 16.04). 
I need to read the file from the servlet. The code in servlet is: 
    Credentials credentials = null;
    String password = "secretPassword";
    String pathToWalletFile = "/home/ubuntu/.ethereum/testnet/keystore/UTC--2017-06-18T03-11-13.235052023Z--6c992fb9531c9285ca9aba80c32a63074b0acd00";
    File file = new File(pathToWalletFile);

    try {
        credentials = WalletUtils.loadCredentials(
                password,
                file
        );
    } catch (CipherException e) {
        e.printStackTrace();
    }

the file has permissions: 644 (-rw-r--r--) Tomcat8 installed with default settings using 'sudo apt install tomcat8' on Ubuntu 16.04 (user: tomcat8) 
If I call servlet I get the following error: 
HTTP Status 500 - /home/ubuntu/.ethereum/testnet/keystore/UTC--2017-06-18T03-11-13.235052023Z--6c992fb9531c9285ca9aba80c32a63074b0acd00 (Permission denied)

type Exception report

message /home/ubuntu/.ethereum/testnet/keystore/UTC--2017-06-18T03-11-13.235052023Z--6c992fb9531c9285ca9aba80c32a63074b0acd00 (Permission denied)

description The server encountered an internal error that prevented it from fulfilling this request.

exception

java.io.FileNotFoundException: /home/ubuntu/.ethereum/testnet/keystore/UTC--2017-06-18T03-11-13.235052023Z--6c992fb9531c9285ca9aba80c32a63074b0acd00 (Permission denied)
java.io.FileInputStream.open0(Native Method)
java.io.FileInputStream.open(FileInputStream.java:195)
java.io.FileInputStream.<init>(FileInputStream.java:138)
com.fasterxml.jackson.core.JsonFactory.createParser(JsonFactory.java:756)
com.fasterxml.jackson.databind.ObjectMapper.readValue(ObjectMapper.java:2740)
org.web3j.crypto.WalletUtils.loadCredentials(WalletUtils.java:76)
net.cryptonomica.tomcatweb3j.TestServlet.doGet(TestServlet.java:75)
javax.servlet.http.HttpServlet.service(HttpServlet.java:622)
javax.servlet.http.HttpServlet.service(HttpServlet.java:729)
org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)

note The full stack trace of the root cause is available in the Apache Tomcat/8.0.32 (Ubuntu) logs.

Apache Tomcat/8.0.32 (Ubuntu)

If I put the file inside WEB-INF, it works. How to allow access to files outside WEB-INF in tomcat (or in jetty)? 

UPD: 
User tomcat8 can read /home/ubuntu/.ethereum/ , but can not read /home/ubuntu/.ethereum/testnet/ directory 
$ sudo -u tomcat8 ls /home/ubuntu/.ethereum/testnet/ 

returns:
ls: cannot access '/home/ubuntu/.ethereum/testnet/': Permission denied 

even if I add 'tomcat8' user to 'ubuntu' group 
$members ubuntu 

now returns: 
ubuntu tomcat8

and 
$ ls -l /home/ubuntu/.ethereum/testnet/ 

returns: 
total 8 
drwxr--r-- 5 ubuntu ubuntu 4096 Jun 17 17:33 geth 
srw------- 1 ubuntu ubuntu 0 Jun 18 14:08 geth.ipc 
drwxr--r-- 2 ubuntu ubuntu 4096 Jun 18 03:11 keystore 

But tomcat8 still don't have read access to /home/ubuntu/.ethereum/testnet/ 
Moving file to another directory (where user 'tomcat8' has access) solves problem. But I still not understand where the problem is. In general I'd like to have read access to file /home/ubuntu/.ethereum/testnet/  from servlets

A:

This a basic permission issue.
It looks though as if this file is under the home directory of the ubuntu user. It would be a bad idea to change permissions in that case. The better alternative would be to move the storage of these files outside any specific user's home directory or, better, move them to the tomcat user's home directory (if the directory is used just for things managed by your server)
Otherwise, what you need to do is find out which user the tomcat process is running as, then grant permissions accordingly:
sudo chown tomcat:tomcat /home/ubuntu/.ethereum/testnet/keystore/UTC--2017-06-18T03-11-13.235052023Z--6c992fb9531c9285ca9aba80c32a63074b0acd00
#OR
sudo chmod a+r /home/ubuntu/.ethereum/testnet/keystore/UTC--2017-06-18T03-11-13.235052023Z--6c992fb9531c9285ca9aba80c32a63074b0acd00
#OR grant folder access if files are dynamically generated
sudo chmod -R a+r /home/ubuntu/.ethereum/testnet/keystore/

The above code assumes the user running tomcat is named tomcat.

