diff --git a/be/src/io/fs/local_file_system.cpp b/be/src/io/fs/local_file_system.cpp
index cf28c7caa09390..55e9466bdee497 100644
--- a/be/src/io/fs/local_file_system.cpp
+++ b/be/src/io/fs/local_file_system.cpp
@@ -48,6 +48,9 @@
 namespace doris {
 namespace io {
 
+std::filesystem::perms LocalFileSystem::PERMS_OWNER_RW =
+        std::filesystem::perms::owner_read | std::filesystem::perms::owner_write;
+
 std::shared_ptr<LocalFileSystem> LocalFileSystem::create(Path path, std::string id) {
     return std::shared_ptr<LocalFileSystem>(new LocalFileSystem(std::move(path), std::move(id)));
 }
@@ -453,5 +456,19 @@ Status LocalFileSystem::_glob(const std::string& pattern, std::vector<std::strin
     return Status::OK();
 }
 
+Status LocalFileSystem::permission(const Path& file, std::filesystem::perms prms) {
+    auto path = absolute_path(file);
+    FILESYSTEM_M(permission_impl(path, prms));
+}
+
+Status LocalFileSystem::permission_impl(const Path& file, std::filesystem::perms prms) {
+    std::error_code ec;
+    std::filesystem::permissions(file, prms, ec);
+    if (ec) {
+        return localfs_error(ec, fmt::format("failed to change file permission {}", file.native()));
+    }
+    return Status::OK();
+}
+
 } // namespace io
 } // namespace doris
diff --git a/be/src/io/fs/local_file_system.h b/be/src/io/fs/local_file_system.h
index a248901689b3ad..705f0ed36e9335 100644
--- a/be/src/io/fs/local_file_system.h
+++ b/be/src/io/fs/local_file_system.h
@@ -62,6 +62,10 @@ class LocalFileSystem final : public FileSystem {
     static bool contain_path(const Path& parent, const Path& sub);
     // delete dir or file
     Status delete_directory_or_file(const Path& path);
+    // change the file permission of the given path
+    Status permission(const Path& file, std::filesystem::perms prms);
+
+    static std::filesystem::perms PERMS_OWNER_RW;
 
     Status canonicalize_local_file(const std::string& dir, const std::string& file_path,
                                    std::string* full_path);
@@ -94,6 +98,7 @@ class LocalFileSystem final : public FileSystem {
                                   const std::function<bool(const FileInfo&)>& cb);
     Status get_space_info_impl(const Path& path, size_t* capacity, size_t* available);
     Status copy_path_impl(const Path& src, const Path& dest);
+    Status permission_impl(const Path& file, std::filesystem::perms prms);
 
 private:
     // a wrapper for glob(), return file list in "res"
diff --git a/be/src/olap/single_replica_compaction.cpp b/be/src/olap/single_replica_compaction.cpp
index fba76765b0adfe..4e8d1bcb338059 100644
--- a/be/src/olap/single_replica_compaction.cpp
+++ b/be/src/olap/single_replica_compaction.cpp
@@ -460,8 +460,8 @@ Status SingleReplicaCompaction::_download_files(DataDir* data_dir,
                              << ", local_file_size=" << local_file_size;
                 return Status::InternalError("downloaded file size is not equal");
             }
-            chmod(local_file_path.c_str(), S_IRUSR | S_IWUSR);
-            return Status::OK();
+            return io::global_local_filesystem()->permission(local_file_path,
+                                                             io::LocalFileSystem::PERMS_OWNER_RW);
         };
         RETURN_IF_ERROR(HttpClient::execute_with_retry(DOWNLOAD_FILE_MAX_RETRY, 1, download_cb));
     } // Clone files from remote backend
diff --git a/be/src/olap/task/engine_clone_task.cpp b/be/src/olap/task/engine_clone_task.cpp
index d0337820fb2994..cd4082af0e088e 100644
--- a/be/src/olap/task/engine_clone_task.cpp
+++ b/be/src/olap/task/engine_clone_task.cpp
@@ -560,8 +560,8 @@ Status EngineCloneTask::_download_files(DataDir* data_dir, const std::string& re
                              << ", local_file_size=" << local_file_size;
                 return Status::InternalError("downloaded file size is not equal");
             }
-            chmod(local_file_path.c_str(), S_IRUSR | S_IWUSR);
-            return Status::OK();
+            return io::global_local_filesystem()->permission(local_file_path,
+                                                             io::LocalFileSystem::PERMS_OWNER_RW);
         };
         RETURN_IF_ERROR(HttpClient::execute_with_retry(DOWNLOAD_FILE_MAX_RETRY, 1, download_cb));
     } // Clone files from remote backend
diff --git a/be/src/runtime/snapshot_loader.cpp b/be/src/runtime/snapshot_loader.cpp
index 53629b8942fab2..f145631548ba41 100644
--- a/be/src/runtime/snapshot_loader.cpp
+++ b/be/src/runtime/snapshot_loader.cpp
@@ -605,8 +605,8 @@ Status SnapshotLoader::remote_http_download(
                                  << ", local_file_size=" << local_file_size;
                     return Status::InternalError("downloaded file size is not equal");
                 }
-                chmod(local_file_path.c_str(), S_IRUSR | S_IWUSR);
-                return Status::OK();
+                return io::global_local_filesystem()->permission(
+                        local_file_path, io::LocalFileSystem::PERMS_OWNER_RW);
             };
             RETURN_IF_ERROR(HttpClient::execute_with_retry(kDownloadFileMaxRetry, 1, download_cb));
 
diff --git a/be/src/service/backend_service.cpp b/be/src/service/backend_service.cpp
index 6cc6bead44d196..68adeb1abe2610 100644
--- a/be/src/service/backend_service.cpp
+++ b/be/src/service/backend_service.cpp
@@ -47,6 +47,7 @@
 #include "gutil/strings/split.h"
 #include "gutil/strings/substitute.h"
 #include "http/http_client.h"
+#include "io/fs/local_file_system.h"
 #include "olap/olap_common.h"
 #include "olap/olap_define.h"
 #include "olap/rowset/beta_rowset.h"
@@ -272,8 +273,8 @@ void _ingest_binlog(StorageEngine& engine, IngestBinlogArg* arg) {
                              << ", local_file_size=" << local_file_size;
                 return Status::InternalError("downloaded file size is not equal");
             }
-            chmod(local_segment_path.c_str(), S_IRUSR | S_IWUSR);
-            return Status::OK();
+            return io::global_local_filesystem()->permission(local_segment_path,
+                                                             io::LocalFileSystem::PERMS_OWNER_RW);
         };
 
         auto status = HttpClient::execute_with_retry(max_retry, 1, get_segment_file_cb);
diff --git a/be/src/service/internal_service.cpp b/be/src/service/internal_service.cpp
index 1f9e6272ce2666..2abd18679082ef 100644
--- a/be/src/service/internal_service.cpp
+++ b/be/src/service/internal_service.cpp
@@ -1448,7 +1448,6 @@ void PInternalService::hand_shake(google::protobuf::RpcController* controller,
 constexpr char HttpProtocol[] = "http://";
 constexpr char DownloadApiPath[] = "/api/_tablet/_download?token=";
 constexpr char FileParam[] = "&file=";
-constexpr auto Permissions = S_IRUSR | S_IWUSR;
 
 static std::string construct_url(const std::string& host_port, const std::string& token,
                                  const std::string& path) {
@@ -1480,8 +1479,9 @@ static Status download_file_action(std::string& remote_file_url, std::string& lo
                 return Status::InternalError("downloaded file size is not equal");
             }
         }
-        chmod(local_file_path.c_str(), Permissions);
-        return Status::OK();
+
+        return io::global_local_filesystem()->permission(local_file_path,
+                                                         io::LocalFileSystem::PERMS_OWNER_RW);
     };
     return HttpClient::execute_with_retry(DOWNLOAD_FILE_MAX_RETRY, 1, download_cb);
 }