Application-specific access privileges in a file system

A system, comprising:

• a processor;
• and
• a memory having instructions stored thereon which, when executed by the processor, performs an operation for managing access to files on a computer file system, the operation comprising:
• receiving, from an application, a request by a user to access a specified file on a file system through the application,
• retrieving, from a permission repository, a permission record based on information about the application, the user, and the specified file,
• determining whether the user has permission to access a directory in the file system in which the specified file is located,
• determining whether the application is allowed to access the specified file, and
• based on determining that the user has permission to access the directory in which the specified file is located and determining that application has permission to access the specified file, retrieving the specified file from the directory and granting the application access to the specified file.

A computer-readable medium having instructions stored thereon which, when executed by a processor, performs an operation for managing access to files on a computer file system, the operation comprising:

• receiving, from an application, a request by a user to access a specified file on a file system through the application;
• retrieving, from a permission repository, a permission record based on information about the application, the user, and the specified file;
• determining whether the user has permission to access a directory in the file system in which the specified file is located;
• determining whether the application is allowed to access the specified file;
• and
• based on determining that the user has permission to access the directory in the file system in which the specified file is located and determining that the application has permission to access files in the directory in which the specified file is located, retrieving the specified file from the directory and granting the application access to the specified file.