System.getProperty("user.home"); should get the user's home directory. As for the permissions I have no idea, but I'd like to know.
In terms of permissions, you can get access the client's computer via JNLP. I've done it before with an app that loads and plays .wav files from a client. However, the system steps in and ask the client to give permission. I used the code presented in this tutorial as my model.
http://download.oracle.com/javase/tutorial/deployment/doingMoreWithRIA/usingJNLPAPI.htmlBut if you want freer access, you will have to look at "Signing".
http://download.oracle.com/javase/tutorial/deployment/jar/signindex.htmlLot's to get confused by in that. I remember having troubles with the Keystore (for Signing) but found some useful background in this article:
http://download.oracle.com/javase/6/docs/technotes/tools/windows/keytool.htmlIf you get it all working, I'll probably be back to ask you for advice. I got side-tracked when I was trying to set this up signing and never finished it.

(I have this topic on "notify," in hopes.)